Is CVE-2026-44381 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44381 being exploited in the wild.

How severe is CVE-2026-44381?

Medium severity, with a CVSS score of 5.3, published 13 May 2026.

Is there a fix for CVE-2026-44381?

A patch was published on 2026-05-13: Fixed in version 2.5.37 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44381 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44381?

Check whether you run Misp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44381: MISP SQL injection in event and shadow attribute listing endpoints

CVE-2026-44381 · Severity: medium · CVSS 5.3 · Published 2026-05-13

MISP is an open-source platform used by organizations to share and analyze threat intelligence. A security flaw in how the platform handles data sorting requests could allow an attacker to interfere with the underlying database. This could lead to unauthorized access to sensitive intelligence data, modification of records, or disruption of the platform's operations.

Technologies: Misp. Vendors: Misp.

Quick answers

Is CVE-2026-44381 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44381 being exploited in the wild.
How severe is CVE-2026-44381?: Medium severity, with a CVSS score of 5.3, published 13 May 2026.
Which products and versions are affected?: MISP Project MISP < 2.5.37.
Is there a fix for CVE-2026-44381?: A patch was published on 2026-05-13: Fixed in version 2.5.37 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44381 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44381?: Check whether you run Misp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability (CWE-89) exists in MISP's event and shadow attribute listing endpoints due to improper validation of user-supplied 'order' or 'sort' parameters. The application directly incorporated these request parameters into database query ORDER BY clauses. A remote attacker can exploit this by crafting malicious ordering parameters to manipulate SQL queries. Depending on database configuration, this may allow for unauthorized data extraction or modification. The vulnerability is resolved in version 2.5.37 by implementing strict validation against allowed model fields and normalizing sort directions.

Affected products

MISP Project MISP < 2.5.37

Timeline

2026-04-29: advisory: Initial GitHub security advisory published
2026-05-13: disclosed: NVD publication date
2026-05-13: patched: Fixed in version 2.5.37

References

https://github.com/MISP/MISP/security/advisories/GHSA-4cxp-22wm-j6jr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.