Is CVE-2026-95679 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95679 being exploited in the wild.

How severe is CVE-2026-95679?

Informational severity, published 22 September 2026.

Which products and versions are affected?

MISP Project MISP prior to fix commit 716fc49d3.

Is there a fix for CVE-2026-95679?

A patch was published on 2026-09-22: Fix merged in MISP commit 716fc49d3 restricting XML decoding to actual documents Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-95679 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-95679?

Check whether you run MISP Project MISP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95679: MISP RequestHandlerComponent SSRF in cspReport endpoint

CVE-2026-95679 · Severity: info · Published 2026-09-22

MISP's security event reporting feature automatically decodes and processes XML requests without proper validation, allowing an unauthenticated attacker to trigger outbound HTTPS connections to arbitrary targets. An attacker can exploit this to probe internal services, trigger actions on internal systems, or gather network information about the server's environment, but cannot directly retrieve data from those services.

Technologies: MISP Project MISP. Vendors: MISP Project.

Quick answers

Is CVE-2026-95679 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95679 being exploited in the wild.
How severe is CVE-2026-95679?: Informational severity, published 22 September 2026.
Which products and versions are affected?: MISP Project MISP prior to fix commit 716fc49d3.
Is there a fix for CVE-2026-95679?: A patch was published on 2026-09-22: Fix merged in MISP commit 716fc49d3 restricting XML decoding to actual documents Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95679 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-95679?: Check whether you run MISP Project MISP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The RequestHandlerComponent automatically decodes XML request bodies on write operations. The underlying Xml::build() library contains a logic error in its readFile guard condition (readFile && http || https), where PHP operator precedence causes https URLs to bypass the readFile check, enabling arbitrary URL fetching. The unauthenticated cspReport endpoint accepts XML content type, allowing an unauthenticated remote attacker to send a crafted POST request that triggers server-side HTTPS requests to internal or external services reachable from the MISP server.

Affected products

MISP Project MISP prior to fix commit 716fc49d3

Timeline

2026-09-22: disclosed: Vulnerability published on NVD
2026-09-22: patched: Fix merged in MISP commit 716fc49d3 restricting XML decoding to actual documents

References

https://github.com/MISP/MISP/commit/716fc49d3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.