CVE-2026-54359: MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default
MISP contains an insecure default configuration in which the Security.checksecfetchsiteheader control is disabled. When this setting is disabled, state-changing requests such as POST, PUT, or AJAX requests are not restricted based on the browser-provided Sec-Fetch-Site header. A remote unauthenticated attacker could craft a malicious web page that causes an authenticated MISP user’s browser to issue cross-site requests to MISP automation endpoints. If successful, the forged requests may be processed with the privileges of the victim user, potentially allowing unauthorized modification of MISP data or configuration. Enabling Security.checksecfetchsiteheader mitigates this issue, although operators of multi-homed MISP deployments should validate the setting before enforcing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable Security.check_sec_fetch_site_header in MISP's security configuration to require and enforce the browser-provided Sec-Fetch-Site header for state-changing requests (e.g., POST, PUT, AJAX).
MISP Security.check_sec_fetch_site_header = enabled - Operational
For multi-homed MISP deployments, validate and test the impact of enabling Security.check_sec_fetch_site_header in a staging or test environment before enforcing it in production to ensure it does not disrupt legitimate cross-origin workflows.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54359?
The severity of CVE-2026-54359 is rated high with a CVSS score of 7.1.
How does CVE-2026-54359 affect MISP users?
CVE-2026-54359 affects MISP users by exposing them to Cross-Site Request Forgery (CSRF) attacks when the Sec-Fetch-Site protection is disabled.
How can I mitigate CVE-2026-54359?
To mitigate CVE-2026-54359, enable the Security.check_sec_fetch_site_header control to protect against CSRF attacks.
When was CVE-2026-54359 published?
CVE-2026-54359 was published on June 12, 2026.
What type of vulnerability is CVE-2026-54359?
CVE-2026-54359 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.