CVE-2026-106513 Details

A remote code execution vulnerability has been identified in MISP, specifically in the handling of Redis host settings for the core application and certain plugins. This issue affects site-admin users who can access the web UI or API. The vulnerability arises because background job workers trust raw Redis job payloads without proper validation. An attacker who compromises a site-admin session, potentially through a stored cross-site scripting vulnerability, can manipulate the Redis host settings to point to an attacker-controlled Redis server. After redirecting the Redis connection, the attacker can inject malicious job payloads that the workers execute, leading to arbitrary command execution as the worker account. Furthermore, the vulnerability allows modification of the download_attachments_on_load setting, which controls inline attachment rendering, potentially facilitating additional client-side attacks.

The vulnerability has been addressed by updating the Redis host settings to be command-line interface only, preventing modifications through the web UI or API. Additionally, the download_attachments_on_load setting has been locked to prevent unauthorized changes. Users should update to the latest version of MISP where this fix has been implemented.