Is CVE-2026-106513 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106513 being exploited in the wild.

How severe is CVE-2026-106513?

Informational severity, published 6 October 2026.

How is CVE-2026-106513 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-106513?

Check whether you run MISP Project MISP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106513: MISP Redis host configuration exposure to site-admin users

CVE-2026-106513 · Severity: info · Published 2026-10-06

MISP, a platform for sharing malware and security threat data, allows site administrators to modify critical Redis server settings through the web interface and API. An attacker who compromises a site-admin account (such as through a stored cross-site scripting flaw) can redirect MISP's workers to connect to an attacker-controlled Redis server and then execute arbitrary commands as the worker process, potentially stealing data or taking over the system.

Technologies: MISP Project MISP. Vendors: MISP Project.

Quick answers

Is CVE-2026-106513 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106513 being exploited in the wild.
How severe is CVE-2026-106513?: Informational severity, published 6 October 2026.
Which products and versions are affected?: MISP Project MISP.
Is there a fix for CVE-2026-106513?: Yes: fixed in MISP commit 2ebf29f (redis host settings flagged cli_only). Until then: Flag the redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) as cli_only configuration options so they can only be set via server config or command line, preventing modification through the web UI and API. Similarly restrict the download_attachments_on_load setting to prevent re-enablement of inline attachment rendering by a hijacked session. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106513 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-106513?: Check whether you run MISP Project MISP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MISP commit 2ebf29f (redis host settings flagged cli_only)

Flag the redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) as cli_only configuration options so they can only be set via server config or command line, preventing modification through the web UI and API. Similarly restrict the download_attachments_on_load setting to prevent re-enablement of inline attachment rendering by a hijacked session.

Technical details

The vulnerability allows modification of MISP.redis_host, Plugin.ZeroMQ_redis_host, and SimpleBackgroundJobs.redis_host settings via the web UI and API by site-admin users. Background job workers execute raw Redis payloads without validation; an attacker with a hijacked site-admin session can reconfigure these endpoints to point to a malicious Redis instance and trigger worker restart, leading to arbitrary command execution in the worker process context. The download_attachments_on_load setting is similarly exposed, potentially re-enabling client-side attack vectors.

Affected products

MISP Project MISP

Timeline

2026-10-06: disclosed
2026-10-06: patched: commit 2ebf29f makes redis host settings cli_only

References

https://github.com/MISP/MISP/commit/2ebf29f93

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.