CVE-2026-85221 is an improper TLS certificate validation flaw in the MISP CurlClient class (CVSS 9.1, critical). An uninitialized setting effectively turned off peer verification. The upstream fix verifies peers by default, so update MISP. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record says the CurlClient verifyPeer property was never initialized, so it defaulted to null. Passed to cURL, that value effectively disabled TLS peer verification unless calling code turned it on. The weakness is CWE-295, improper certificate validation.
HTTPS connections made through affected instances could accept certificates not issued by a trusted authority. The patch turns verification on by default, keeps support for configured self signed certificates, and fixes how SyncTool handles pinned certificates. The record gives no release number, so check the MISP release notes. The record is not in the CISA KEV catalog.
How to check if you're exposed
Check your MISP version against the release notes for the change titled to verify TLS peers by default (commit e06f69858). Review which remote services your MISP reaches over HTTPS, such as feeds and sync partners, and whether those paths use CurlClient.
What to do now
- Update MISP to a build that includes the CurlClient fix.
- If you use self signed certificates for sync, configure the pinned CA certificate so verification stays on.
- Rotate credentials and API keys that MISP sent over HTTPS to remote services, if interception on your path is plausible.
- Review feed and sync settings for any option that disables certificate checks.
Why it matters
In PHP and cURL, an unset value can mean something different from a safe default. Here null behaved like off. A security setting should be explicit, with a safe default and a clear way to opt out.
The impact depends on the traffic. Sync links carry API keys and threat data, so a man in the middle could both read and alter what the instance receives.
Quick check
Do I need network access for an attacker to exploit this?
An attacker must be able to intercept or change traffic between your MISP and a remote HTTPS service. The impact depends on the functionality using CurlClient and the data exchanged.
Sources
Last reviewed: 19 October 2026.
