Remote Code Execution Vulnerability in MISP by Affected Redis Configuration

CVE-2026-106513

What is CVE-2026-106513?

The Malware Information Sharing Platform (MISP) contains a vulnerability that exposes sensitive Redis host configurations through its web interface and API to users with site-admin privileges. This vulnerability arises from insufficient validation of Redis job payloads by background job workers. If an attacker successfully hijacks a site-admin session, they can manipulate the Redis settings to connect to a malicious Redis server. This allows them to inject harmful job payloads that the workers may execute with the privileges of the site-admin. Furthermore, the attacker can modify the download_attachments_on_load setting, potentially enabling client-side attacks. Since the vulnerability requires elevated privileges and a prior session compromise, it emphasizes the necessity for strong session management and validation mechanisms.

References