PT-2026-48971 · Misp · Misp

Andras Iklody · Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-54359

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description An insecure default configuration exists where the Security.check sec fetch site header control is disabled. This allows state-changing requests, such as POST, PUT, or AJAX requests, to be processed without restriction based on the browser-provided Sec-Fetch-Site header. A remote unauthenticated attacker can craft a malicious web page that tricks an authenticated user's browser into sending cross-site requests to automation endpoints. These forged requests are processed with the victim's privileges, which may lead to unauthorized modification of data or configuration.

Recommendations Enable the Security.check sec fetch site header setting. Operators of multi-homed deployments should validate this setting before enforcement.

Fix

CSRF

Weakness Enumeration

CWE-1188

CWE-352

Related Identifiers

CVE-2026-54359

Affected Products

Misp

References · 3

• https://github.com/MISP/MISP/commit/b82db1bcaa550689c05e1ed175e81f25a8d97b91 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-54359 · Security Note
• https://twitter.com/VulmonFeeds/status/2065580981080195486 · Twitter Post