CVE-2026-86440 MISP CVE debrief

Who should care

Defenders and administrators of MISP installations should assess exposure and prioritize verification and updates to prevent potential attacks. MISP users and security teams should review and validate URLs used by dashboard widgets and monitor for potential XSS attacks. Affected operator, platform, vulnerability-management, and security-team impact should be considered when assessing exposure.

Why it matters

CVE-2026-86440 is a vulnerability in MISP dashboard widget URL validation that allows for stored XSS attacks. Defenders and administrators of MISP installations should assess exposure and prioritize verification and updates to prevent potential attacks.

• Potential for stored XSS attacks
• Need for verification and updates to prevent attacks
• Possible impact on MISP installations

Technical summary

The MISP dashboard widget URL validation vulnerability allows for stored XSS attacks. The vulnerability exists in versions ≤2.5.45 and is caused by insufficient validation of URLs used by dashboard widgets, particularly the Button widget. The fix involves routing widget URLs through a shared DashboardURLValidator and rejecting dangerous schemes. Defenders should prioritize verifying and updating MISP installations to prevent potential XSS attacks. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM. The CVE record and NVD entry provide details on the vulnerability.

Defensive priority

Defenders should prioritize verifying and updating MISP installations to prevent potential XSS attacks.

Recommended defensive actions

• Verify MISP installations and update to version 2.5.46 or later
• Review and validate URLs used by dashboard widgets
• Monitor for potential XSS attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, with evidence indicating that MISP dashboard widget URL validation is insufficient, allowing for stored XSS attacks. Further verification is needed to determine the full scope of affected systems and potential impact. The fix involves routing widget URLs through a shared DashboardURLValidator and rejecting dangerous schemes. Affected product deployments should be verified, and compensating controls should be reviewed for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.