CVE-2026-86419 is an SSRF and credential forwarding flaw in MISP feed retrieval and TAXII discovery, affecting versions up to 2.5.45 (CVSS 9.1, critical). Update MISP to a build that contains the upstream commits. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record says MISP versions up to 2.5.45 are affected. The weaknesses are CWE-200 and CWE-918, exposure of sensitive information and server side request forgery.
In feed processing, redirects were followed without checking the scheme or destination, and request headers were reused across hops, so a feed credential could reach another host. Redirects could also target internal resources. TAXII discovery used a weak address check that missed cases such as IPv6 loopback and numeric host encodings. The fix adds redirect validation, blocks internal destinations on cross host redirects, strips feed credentials before such redirects, and pins validated DNS results. The record gives no fixed release number, so check the MISP release notes. The record is not in the CISA KEV catalog.
How to check if you're exposed
Read your MISP version from the About page or the VERSION.json file.
cat /var/www/MISP/VERSION.json
If it is 2.5.45 or older, you are in the affected range. Review your configured feeds and TAXII servers, especially any that use credentials.
What to do now
- Update MISP to a release that contains the commits 06f541dcf and 08d6efe24.
- Review configured feeds and remove ones you do not recognize.
- Rotate credentials configured for feeds that point to third party hosts.
- Restrict outbound traffic from the MISP server so it cannot reach internal management services.
- Check logs for feed fetches that ended on unexpected hosts.
Why it matters
Server side request forgery turns your server into a proxy for requests chosen by someone else. Redirects make it harder, since a safe looking URL can send the client elsewhere after validation.
The fix pattern is worth copying: validate every hop, block internal ranges, strip credentials on cross host moves, and pin DNS so the checked address is the one used.
Quick check
Why is credential forwarding a separate concern?
If headers are reused on a redirect, an API key meant for one host can be sent to another host the attacker controls.
Sources
Last reviewed: 19 October 2026.
