Executive brief
MISP is an open-source threat intelligence platform used by organizations to share and analyze security information. A flaw in its CurlClient component caused TLS certificate validation to be disabled by default, allowing attackers who intercept network traffic to impersonate legitimate HTTPS endpoints and perform man-in-the-middle attacks. Attackers could steal authentication credentials, view sensitive threat intelligence data, and inject false information into MISP.
Technical details
The vulnerability is an improper TLS certificate validation flaw in MISP's CurlClient class. The CurlClient::$verifyPeer property was not explicitly initialized and defaulted to null; when passed to cURL, this value effectively disabled peer verification unless calling code explicitly enabled it. The attack vector is network-based and requires an attacker to position themselves on the network path between the MISP instance and remote HTTPS services. No authentication is required from the attacker's perspective. Successful exploitation allows observation and modification of sensitive data exchanged with remote endpoints, including authentication material and threat intelligence. The vendor released a patch that enables TLS peer verification by default while preserving support for configured self-signed certificates.
Affected products
- MISP Project MISP versions prior to patch (exact range not specified)
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fix commit e06f698 released