CVE-2026-86419: MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery
Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality.
In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forwarded to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results to prevent re-resolution after validation.
The TAXII discovery endpoint had a related incomplete SSRF defense. It used gethostbyname() and compared the result against only a few literal addresses. This missed cases including IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and potentially multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.
Together, these commits harden MISP's outbound URL handling against alternate-address representations, DNS-related bypasses, unsafe redirects, internal-host access, and cross-host credential forwarding.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in ≤2.5.45 - Configuration
Enable redirect validation when processing feed retrieval so that the redirect scheme and destination are validated before following redirects.
MISP feed retrieval redirects redirect validation = enabled - Configuration
Strip configured feed credentials before following a redirect to another host to prevent forwarding authentication headers/API credentials across redirect hops.
MISP feed processing redirect cross-host credential handling = strip - Configuration
Block internal destinations for cross-host redirects during outbound URL handling to prevent SSRF to internal network resources.
MISP outbound URL handling internal destination blocking for cross-host redirects = blocked - Configuration
Pin validated DNS results and prevent re-resolution after validation to avoid DNS-related bypasses.
MISP outbound URL handling DNS pinning after validation = enabled - Configuration
Move TAXII discovery outbound URL handling to the shared URL egress validator to harden the SSRF defense.
MISP TAXII discovery outbound URL egress validation path = use shared URL egress validator - Compensating control
Block internal destination access for MISP feed retrieval/TAXII discovery egress (e.g., prevent redirects to internal network resources) to mitigate SSRF.
Event History
Frequently Asked Questions
Which deployments are most exposed to credential disclosure?
MISP deployments that retrieve feeds configured with authentication headers or API credentials are exposed if a feed can redirect requests to a different host. Before the fix, those original request headers were reused on redirect hops and could be sent to the redirected destination.
What redirect targets could be used for server-side request forgery?
A feed redirect could target internal network resources because the redirect destination and scheme were not adequately validated. The TAXII discovery handling also missed IPv6 loopback, numeric host encodings such as 0x7f000001, and cases involving multiple DNS records.
What conditions are needed to exploit the feed-related issue?
The issue depends on MISP retrieving a feed whose response causes a redirect. Credential disclosure additionally requires that the feed be configured with authentication headers or API credentials.
What protections were added by the fix?
The fix validates redirects, blocks internal destinations for cross-host redirects, and removes configured feed credentials before following a redirect to another host. It also pins validated DNS results to prevent re-resolution after validation and moves TAXII discovery to the shared URL egress validator.