CVE-2026-106513

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description Critical infrastructure settings, specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin, are exposed through the web UI and API to site-admin users. Because background job workers trust raw Redis job payloads without additional validation, an attacker with a hijacked site-admin session can redirect these settings to an attacker-controlled Redis server and restart the workers. This allows the injection of malicious job payloads, leading to arbitrary command execution as the worker account and potential data exfiltration. Furthermore, the download attachments on load setting, which manages inline attachment rendering, is modifiable via the same interface, potentially facilitating client-side attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.