RCE in Misp
CVE-2026-54359
MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. When this setting is disabled, state-changing requests such as POST, PUT, or AJAX requests are not restricted based on t…
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.002 (8.9th percentile) — read the EPSS interpretation.
Affected products
- Misp — versions 0