Cross-Site Request Forgery Vulnerability in MISP Modules by MISP
CVE-2026-44364

9.3CRITICAL

Key Information:

Vendor

Misp

Status
Misp-modules
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44364?

MISP Modules prior to version 3.0.8 are vulnerable to a Cross-Site Request Forgery (CSRF), which could allow an attacker to manipulate the behaviors of an authenticated user without their consent. This vulnerability arises from the home blueprint not being protected against CSRF attacks, leading to potential unauthorized requests being made in the context of the user's session. After this issue was identified, MISP implemented CSRF protection for the affected blueprint and enhanced the parsing of queries to mitigate risks.

Affected Version(s)

misp-modules <= 3.0.7

References

https://github.com/MISP/misp-modules/security/advisories/...
x_refsource_CONFIRM

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.