Insufficient URL Validation in MISP by GMSP Technologies

CVE-2026-86351

What is CVE-2026-86351?

The identified vulnerability in MISP stems from inadequate validation of the user-configurable homepage, allowing for the exploitation via unrestricted protocol-relative URLs. Specifically, paths that begin with '/' can be erroneously validated, thus enabling attackers to inject malicious URLs such as '//attacker.example'. This flaw can lead to improper post-login URL redirection, posing security risks. To mitigate this issue, a fix has been introduced that implements an InternalRedirectValidator. This new validation method substantially strengthens the security by rejecting URLs that include external hosts or schemes, malformed structures, and protecting against unsafe leading characters. Additionally, it ensures that legacy unsafe values are addressed during read operations, enhancing overall integrity and security during user sessions.

References