CVE-2026-94372: MISP Galaxy Index XSS Vulnerability

CVE-2026-94372 Overview

CVE-2026-94372 is a stored cross-site scripting (XSS) vulnerability in MISP, the open-source Malware Information Sharing Platform. The flaw resides in the default theme's Galaxies index page, where sample tag names from unrecognized custom or default galaxy clusters are rendered without HTML-entity encoding. A user with tag-editor privileges can craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator later views the Galaxies index page, the crafted markup executes in the administrator's browser session. The Overmind theme already escaped these values and is not affected. The issue is tracked as [CWE-79] and impacts MISP versions prior to 2.5.47.

Critical Impact
An authenticated tag-editor can hijack an administrator's browser session, read session data, or perform authenticated actions against the MISP web interface on the administrator's behalf.

Affected Products

MISP versions prior to 2.5.47
Deployments using the default MISP theme
Instances that synchronize with external MISP feeds and encounter unknown galaxy clusters

Discovery Timeline

2026-09-21 - CVE-2026-94372 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94372

Vulnerability Analysis

MISP notifies site administrators when synchronization surfaces galaxy clusters that the local instance does not recognize. The default theme's app/View/Galaxies/index.ctp view assembles a bulleted list of sample tag names inside an informational alert. Sample values are pulled from $unknownClustersDetails['unknownCustomClustersSamples'] and $unknownClustersDetails['unknownDefaultClustersSamples'] and passed directly to sprintf and implode without invoking MISP's h() HTML-escape helper.

Because misp-galaxy tag names originate from user-controlled input, a tag with a name such as <img src=x onerror=...> is inserted verbatim into the DOM. The browser parses the injected markup as executable HTML rather than text. The vulnerability is stored: the malicious tag persists in the database and fires each time an administrator loads the Galaxies index in the default theme.

Root Cause

The root cause is missing output encoding in a Cake PHP view template. The Overmind theme applied h() to the same values and is unaffected, confirming that the defect is isolated to the default theme's rendering logic rather than the underlying data model.

Attack Vector

Exploitation requires two preconditions. First, the attacker needs an account with tag-editor privileges to create or rename a misp-galaxy tag. Second, a site administrator must view the Galaxies index page using the default theme after the malicious cluster has been observed during synchronization. Impact is confined to the administrator's browser context and does not directly compromise the MISP server process.

text

// Patch to app/View/Galaxies/index.ctp (upstream fix)
 if ($hasUnknownCustomClusters) {
     $severity = 'info';
     $content = sprintf(' %s', __('Your instance has detected ... Sample(s):', $unknownClustersDetails['unknownCustomClusters']));
-    $tagSampleHTML = sprintf('<li>%s</li>', implode('</li><li>', $unknownClustersDetails['unknownCustomClustersSamples']));
+    $tagSampleHTML = sprintf('<li>%s</li>', implode('</li><li>', array_map('h', $unknownClustersDetails['unknownCustomClustersSamples'])));
     $content .= $tagSampleHTML;
     $notices[] = sprintf('<div class="alert alert-%s" ...>...</div>', $severity, __('Info'), $content);
 }
 if ($hasUnknownDefaultClusters) {
     $severity = 'info';
     $content = sprintf(' %s', __('Your instance has detected ... Sample(s):', $unknownClustersDetails['unknownDefaultClusters']));
-    $tagSampleHTML = sprintf('<li>%s</li>', implode('</li><li>', $unknownClustersDetails['unknownDefaultClustersSamples']));
+    $tagSampleHTML = sprintf('<li>%s</li>', implode('</li><li>', array_map('h', $unknownClustersDetails['unknownDefaultClustersSamples'])));
     $content .= $tagSampleHTML;
     $notices[] = sprintf('<div class="alert alert-%s" ...>...</div>', $severity, __('Info'), $content);
 }

Source: MISP commit ce10436ae. The patch wraps the sample arrays with array_map('h', ...), applying CakePHP's HTML-entity encoding helper before concatenation.

Detection Methods for CVE-2026-94372

Indicators of Compromise

misp-galaxy tag names containing HTML tags, JavaScript URIs, or characters such as <, >, ", or onerror=.
Audit log entries showing tag creation or edits by non-administrator tag-editor accounts followed by administrator visits to /galaxies or /galaxies/index.
Unexpected outbound requests from administrator browsers immediately after loading the Galaxies index page.

Detection Strategies

Query the MISP tags table for entries whose name contains angle brackets, javascript:, or event-handler substrings.
Review web server access logs for GET /galaxies requests by administrator sessions and correlate with recent tag mutations.
Inspect synchronization logs for unknown-cluster notices that reference suspicious sample names.

Monitoring Recommendations

Enable and centralize MISP audit logs, forwarding tag create/update events to a SIEM for correlation.
Alert on privileged-user browser sessions that generate unexpected XHR or fetch traffic shortly after visiting /galaxies.
Track theme configuration changes so that reverting from Overmind to the default theme is visible to defenders.

How to Mitigate CVE-2026-94372

Immediate Actions Required

Upgrade MISP to version 2.5.47 or later, which includes the escaping fix from commit ce10436ae.
Audit existing misp-galaxy tags for HTML or script content and delete or rename any suspicious entries before administrators load the Galaxies page.
Review the tag-editor role assignments and revoke the permission from accounts that do not require it.

Patch Information

The upstream fix is applied in app/View/Galaxies/index.ctp and wraps unknownCustomClustersSamples and unknownDefaultClustersSamples with array_map('h', ...) prior to rendering. See the MISP GitHub commit ce10436ae for the full diff. Apply the patch by upgrading to MISP 2.5.47 or a later release.

Workarounds

Switch the site theme to Overmind, which already HTML-encodes the affected sample values.
Restrict tag-editor privileges to trusted operators until the patch is deployed.
Temporarily suppress synchronization from untrusted MISP feeds to reduce the chance of malicious cluster samples reaching administrators.

bash

# Upgrade MISP via the standard git workflow
cd /var/www/MISP
sudo -u www-data git fetch --tags
sudo -u www-data git checkout v2.5.47
sudo -u www-data git submodule update --init --recursive
sudo systemctl restart apache2