CVE-2026-86351 MISP CVE debrief

Who should care

Defenders responsible for MISP installations, especially those using user-configurable homepages, should assess exposure and verify their systems. This includes operators, platform administrators, vulnerability management teams, and security teams who need to prioritize verifying MISP installations for version 2.5.45 or later.

Why it matters

CVE-2026-86351 is a vulnerability in MISP that allows attackers to redirect users to external origins after login, potentially leading to phishing or further exploitation. Defenders should prioritize verifying MISP installations for version 2.5.45 or later, especially if user-configurable homepages are used.

• Potential for attackers to redirect users to external origins after login
• Risk of phishing or further exploitation through protocol-relative URLs
• Need for verification of MISP version and homepage validation
• Importance of implementing additional validation for protocol-relative URLs

Technical summary

The MISP application validates user-configurable homepages by checking if the supplied path begins with /. However, this check is insufficient for protocol-relative URLs like //attacker.example, which also start with / but resolve to an external origin in browsers. An attacker can store a vulnerable homepage value as a user setting, which is later used by the post-login routing logic. The fix introduces a shared InternalRedirectValidator that rejects URLs containing a host, scheme, userinfo, unsafe leading // or /<backslash>, malformed URLs, and control characters.

Defensive priority

Defenders should prioritize verifying MISP installations for version 2.5.45 or later, especially if user-configurable homepages are used.

Recommended defensive actions

• Verify MISP installations for version 2.5.45 or later
• Review user-configurable homepages for proper validation
• Implement additional validation for protocol-relative URLs
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in MISP versions ≤2.5.45, where the validation of user-configurable homepages is insufficient. The vulnerability allows attackers to store a vulnerable homepage value as a user setting, which is later used by the post-login routing logic. The fix introduces a shared InternalRedirectValidator that rejects URLs containing a host, scheme, userinfo, unsafe leading // or /<backslash>, malformed URLs, and control characters. Defenders should verify MISP installations for the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.