CVE-2026-86419

MISP versions up to and including 2.5.45 insufficiently validate server-side outbound HTTP destinations used for feed retrieval and TAXII discovery, allowing redirects to be followed to unvalidated schemes and destinations. In feed processing, this enables SSRF into internal network resources and causes configured feed credentials (API keys or authentication headers) to be reused across redirect hops and leaked to other hosts; in TAXII discovery, the incomplete check based on gethostbyname() and a small list of literal addresses can be bypassed using IPv6 loopback (::1), numeric host encodings such as 0x7f000001, or multiple DNS records. An attacker who can influence a configured feed source or TAXII URL (for example by controlling the feed host, its redirects, or DNS resolution) gains unauthorized access to internal services and potential capture of feed credentials, though the CVSS vector indicates privileged configuration access (PR:H) is part of the attack context. Any organization running an affected MISP version that uses feed ingestion or TAXII integration is affected. No public proof-of-concept, KEV listing, or known in-the-wild exploitation exists, and EPSS assigns a low 0.3% probability of exploitation within 30 days.

What to do: Upgrade MISP to a release newer than 2.5.45 that includes the shared URL egress validator and the feed redirect-validation fixes. As interim mitigations, restrict MISP server egress with network-level allowlists so it cannot reach internal-only services, review whether any feeds carry privileged API credentials that could be forwarded to other hosts via redirects, and check outbound HTTP/DNS logs for unexpected redirect hops or requests to internal addresses such as loopback or hex-encoded hosts.