CVE-2026-95658: MISP WorkflowsController CSRF Vulnerability

CVE-2026-95658 Overview

CVE-2026-95658 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Malware Information Sharing Platform (MISP). The WorkflowsController listed the moduleStatelessExecution action in the CakePHP Security component's unlockedActions list, which disables both CSRF token checks and field hash validation. Because moduleStatelessExecution invokes a workflow module's exec() method with attacker-controlled input, a crafted cross-origin request submitted through an authenticated administrator's browser can trigger arbitrary workflow module execution on the MISP instance. The issue was identified during an internal security review and fixed in MISP v2.5.47.

Critical Impact
An attacker can coerce an authenticated MISP administrator's browser to execute arbitrary workflow action modules, including those that write blocklist and warninglist entries, resulting in high integrity impact on security-relevant data.

Affected Products

MISP versions prior to v2.5.47
MISP WorkflowsController component (app/Controller/WorkflowsController.php)
MISP workflow module execution dialog (app/View/Elements/Workflows/execute_module.ctp)

Discovery Timeline

2026-09-22 - CVE-2026-95658 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95658

Vulnerability Analysis

The WorkflowsController in MISP appended the moduleStatelessExecution action to CakePHP's Security->unlockedActions array. In CakePHP, this configuration removes both the CSRF token validation and the form field hash check for the listed action. The moduleStatelessExecution endpoint executes a caller-selected workflow module's exec() method using request-supplied input and parameters.

Because the endpoint accepts arbitrary module identifiers and parameter payloads, an attacker who lures an authenticated site administrator to a malicious page can submit a cross-site form post that reaches the MISP instance with the administrator's session cookies. Workflow action modules include capabilities that mutate persistent security data, such as blocklist and warninglist entries. Exploitation therefore results in unauthorized writes to threat intelligence content used by downstream consumers.

Root Cause

The root cause is an over-broad entry in the Security component's exemption list. unlockedActions was intended to accommodate endpoints that cannot produce CakePHP field hashes, but it also removed CSRF protection from an action that performs sensitive, state-changing operations. The fix replaces the blanket exemption with _csrfTokenHeaderOnly, which retains CSRF validation while allowing the token to be delivered via the X-CSRF-Token header rather than as a form field.

Attack Vector

Exploitation requires user interaction from an authenticated MISP administrator. The attacker hosts an external page that issues a cross-origin POST request, or embeds an auto-submitting form, targeting the MISP moduleStatelessExecution route. When the administrator visits the page, the browser attaches the MISP session cookie and the request is accepted without a CSRF token, executing the attacker-chosen workflow module with attacker-supplied parameters.

php

// Patch: app/Controller/WorkflowsController.php
     {
         parent::beforeFilter();
         $this->Security->unlockedActions[] = 'checkGraph';
-        $this->Security->unlockedActions[] = 'moduleStatelessExecution';
+        // moduleStatelessExecution runs a module's exec() with caller-supplied
+        // input and parameters, so it keeps the CSRF check: unlockedActions
+        // would drop that as well as the field hash, and the module dialog
+        // posts a hand-built object that can never produce a field hash. The
+        // dialog sends the token in the X-CSRF-Token header instead.
+        $this->_csrfTokenHeaderOnly(['moduleStatelessExecution']);
         $requirementErrors = [];
         if (empty(Configure::read('MISP.background_jobs'))) {
             $requirementErrors[] = __('Background workers must be enabled to use workflows');

Source: MISP commit f05e0d1c2

Detection Methods for CVE-2026-95658

Indicators of Compromise

Unexpected POST requests to the MISP moduleStatelessExecution endpoint with an HTTP Referer or Origin header pointing to an external, untrusted domain.
Blocklist or warninglist entries created or modified without a corresponding administrator-initiated audit trail entry.
Requests to moduleStatelessExecution missing the X-CSRF-Token header on unpatched instances.

Detection Strategies

Review MISP audit logs for workflow module executions that do not correlate with legitimate administrator activity or scheduled workflow runs.
Inspect reverse proxy or web server logs for cross-origin requests targeting workflow controller routes.
Correlate administrator browser session activity with server-side workflow execution timestamps to identify coerced requests.

Monitoring Recommendations

Enable and forward MISP audit logs to a centralized log platform for retention and correlation with authentication events.
Alert on any modification to blocklist and warninglist tables that originates from workflow action modules invoked via moduleStatelessExecution.
Monitor for outbound requests from administrator workstations to newly registered or low-reputation domains that could host CSRF payloads.

How to Mitigate CVE-2026-95658

Immediate Actions Required

Upgrade MISP to version v2.5.47 or later, which restores CSRF validation on moduleStatelessExecution via header-only token delivery.
Audit recent blocklist and warninglist changes and revert any entries that cannot be attributed to a legitimate administrator action.
Instruct MISP administrators to avoid browsing untrusted sites within sessions that are authenticated to MISP.

Patch Information

The fix is included in MISP v2.5.47. The patch removes moduleStatelessExecution from Security->unlockedActions and applies _csrfTokenHeaderOnly(['moduleStatelessExecution']), keeping CSRF validation while allowing the workflow module dialog to submit the token through the X-CSRF-Token header. See the MISP commit f05e0d1c2 for the complete change set.

Workarounds

Restrict access to the MISP administrative interface using network-level controls or a reverse proxy that enforces same-origin request policies.
Require administrators to use a dedicated browser or browser profile for MISP that is not used for general web browsing.
Deploy a web application firewall rule that rejects POST requests to workflow controller endpoints when the Origin or Referer header does not match the MISP instance hostname.

bash

# Example reverse proxy rule enforcing same-origin for the workflow endpoint
location ~ ^/workflows/moduleStatelessExecution {
    if ($http_origin !~* ^https://misp\.example\.com$) {
        return 403;
    }
    proxy_pass http://misp_backend;
}