CVE-2026-95679: MISP SSRF Vulnerability via XML Parsing

CVE-2026-95679 Overview

CVE-2026-95679 is a blind Server-Side Request Forgery (SSRF) vulnerability in Malware Information Sharing Platform (MISP). The flaw resides in the RequestHandlerComponent, which automatically decodes XML request bodies on all write requests. A logic error in the underlying Xml::build() guard condition allows a bare HTTPS URL supplied in a request body to be treated as a locator and fetched by the server. The unauthenticated cspReport endpoint accepts XML content, making it a reliable trigger. Attackers can force the MISP server to issue outbound HTTPS requests to arbitrary reachable hosts.

Critical Impact
An unauthenticated remote attacker can coerce MISP into probing internal services, triggering actions on internal HTTPS endpoints, or performing timing-based reconnaissance of the server's network environment.

Affected Products

MISP (Malware Information Sharing Platform)
MISP deployments where the cspReport endpoint is reachable
MISP servers with network access to internal or external HTTPS services

Discovery Timeline

2026-09-22 - CVE-2026-95679 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95679

Vulnerability Analysis

The MISP AppController wires the CakePHP RequestHandlerComponent to decode XML on any write request. Decoding is delegated to Xml::build(), which inspects the input to decide whether the payload is an inline document or a locator to fetch. The guard that gates locator fetching is written as $options['readFile'] && http || https. Because PHP evaluates && before ||, the https branch is never gated by the readFile flag.

The result: any XML body that is a bare https:// URL causes the server to issue an outbound HTTPS request to that URL. The cspReport endpoint is designed to be unauthenticated and accepts XML content, which turns it into a blind SSRF entry point. The attacker does not read the response body but can observe timing and side effects to enumerate internal services and trigger state-changing HTTPS calls reachable from the MISP host. The issue is classified as Improper Input Validation [CWE-20].

Root Cause

The root cause is operator precedence in the Xml::build() readFile guard combined with MISP automatically decoding XML on every write request. Any endpoint accepting XML content, including the unauthenticated cspReport endpoint, invokes the vulnerable code path. Bodies that are URLs rather than documents are fetched instead of parsed.

Attack Vector

An unauthenticated attacker sends a POST request to the MISP cspReport endpoint with Content-Type: application/xml and a body containing a bare https:// URL pointing to an internal or external target. The MISP server performs the outbound HTTPS request. Repeated requests allow port and service enumeration, invocation of unauthenticated internal HTTPS endpoints, and timing-based reconnaissance of internal network topology.

php

         if (Configure::read('Plugin.CustomAuth_enable')) {
             $userLoggedIn = $this->__customAuthentication($_SERVER);
         }
+        // A request body is a document, never a locator. RequestHandlerComponent
+        // decodes an XML body on every write request, and Xml::build() treats a
+        // body that is a bare URL as something to go and fetch: its readFile
+        // guard reads `$options['readFile'] && http || https`, and && binds
+        // tighter than ||, so the https branch is never gated by it. That turns
+        // every endpoint accepting an XML content type - including cspReport,
+        // which is unauthenticated by design - into a blind SSRF. Decode only
+        // what actually looks like a document.
+        $this->RequestHandler->addInputType('xml', [function ($body) {
+            if (!is_string($body) || strpos($body, '<') === false) {
+                return [];
+            }
+            return $this->RequestHandler->convertXml($body);
+        }]);
+
         if ($this->_isRest()) {
             $jsonDecode = function ($dataToDecode) {
                 if (empty($dataToDecode)) {

Source: MISP Commit 716fc49d3. The patch replaces the vulnerable input type handler so only bodies containing a < character (an actual XML document) are passed to the XML parser, ensuring bare URLs are ignored.

Detection Methods for CVE-2026-95679

Indicators of Compromise

POST requests to the cspReport endpoint with Content-Type: application/xml and bodies that are bare http:// or https:// URLs rather than XML documents.
Outbound HTTPS connections from the MISP host to internal RFC1918 ranges, cloud metadata endpoints (169.254.169.254), or unusual external hosts shortly after inbound requests to cspReport.
Web server logs showing repeated short-body POSTs to XML-accepting endpoints from a single source.

Detection Strategies

Inspect HTTP request bodies to XML endpoints and flag payloads that match a URL-only pattern (no < character).
Correlate inbound requests to cspReport with subsequent outbound HTTPS connections from the MISP application host.
Alert on any outbound traffic from MISP to cloud metadata IPs or to internal management interfaces that MISP should not contact.

Monitoring Recommendations

Enable web access logging with request body sampling for cspReport and any other XML-accepting routes.
Capture egress netflow from MISP hosts and baseline expected destinations to surface anomalous outbound HTTPS requests.
Forward MISP application and proxy logs to a centralized analytics platform for correlation between inbound POSTs and outbound fetches.

How to Mitigate CVE-2026-95679

Immediate Actions Required

Apply the upstream MISP patch from commit 716fc49d3 to the AppController XML input handler.
Restrict egress from MISP hosts to only the destinations required for feed synchronization and updates.
Block or authenticate access to the cspReport endpoint at the reverse proxy where operationally feasible.

Patch Information

The fix is contained in MISP commit 716fc49d3. It registers a custom XML input type that verifies the body is a string containing a < character before invoking convertXml, preventing bare URLs from being interpreted as locators by Xml::build().

Workarounds

Place a web application firewall rule in front of MISP that rejects requests to XML endpoints whose body does not contain a < character.
Enforce strict egress firewall policy on MISP servers to deny outbound HTTPS to internal networks and cloud metadata addresses.
Route MISP egress through a filtering proxy that enforces an allowlist of permitted destinations.

bash

# Example egress restriction using iptables to block SSRF targets from MISP host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 443 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 443 -j REJECT