PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54359 misp CVE debrief

CVE-2026-54359 is a HIGH severity vulnerability with a CVSS score of 7.1. The vulnerability exists in MISP due to an insecure default configuration where the Security.check_sec_fetch_site_header control is disabled. This allows a remote unauthenticated attacker to craft a malicious web page that causes an authenticated MISP user’s browser to issue cross-site requests to MISP automation endpoints. Successful exploitation could allow unauthorized modification of MISP data or configuration with the privileges of the victim user.

Vendor
misp
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-15
Advisory published
2026-06-12
Advisory updated
2026-06-15

Who should care

Operators of MISP deployments should be aware of this vulnerability, especially those with multi-homed deployments.

Technical summary

The vulnerability is caused by the disabled Security.check_sec_fetch_site_header control in MISP's default configuration. This control restricts state-changing requests such as POST, PUT, or AJAX requests based on the browser-provided Sec-Fetch-Site header. Without this restriction, an attacker can forge requests that may be processed with the privileges of the victim user.

Defensive priority

High

Recommended defensive actions

  • Enable the Security.check_sec_fetch_site_header control to mitigate this issue.
  • Validate the setting before enforcing it, especially for multi-homed MISP deployments.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. A source reference is available on GitHub, detailing a commit related to this issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54359 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54359

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54359 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54359

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/b82db1bcaa550689c05e1ed175e81f25a8d97b91

    5a6e4751-2f3f-4070-9419-94fb35b644e8

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.