CVE-2026-67178

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description Installation scripts generate an Apache HTTP virtual-host configuration with an incorrectly formatted HTTP-to-HTTPS redirect. Because the destination URL lacks a trailing slash, Apache appends the requested path directly to the hostname. An unauthenticated remote attacker can exploit this by crafting a URL, such as http://misp.example/@attacker.example/, which redirects the user to https://misp.example@attacker.example/. In this scenario, the legitimate domain is interpreted as user information, and the attacker's domain becomes the actual destination. This can be used for phishing, credential collection, or disclosing sensitive query-string information.

Recommendations Review the Apache HTTP virtual-host configuration and ensure the HTTPS redirect destination ends with a trailing slash, for example: Redirect permanent / https://misp.example/. After updating, validate the configuration using apachectl configtest and reload or restart Apache.