Security Resilience

CVE-2026-10856

Open Redirect in Misp-Project Misp ≤ 2.5.39

Open Redirect
Published
04 June 2026
Modified
22 July 2026
Patch / advisory
View advisory
CVSS Score v4 5.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green
EPSS Score 0.0015 4th percentile
Risk Priority 22 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-10856 is a medium-severity Open Redirect (CWE-601) vulnerability in Misp-Project Misp. Its CVSS base score is 5.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Input Capture (T1056); ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by browsers as an external URL. The validation rejected URLs containing an explicit scheme, host,…

more

or user component, but did not reject paths beginning with a slash followed by a backslash, such as /\example.com. Some browsers normalize backslashes in URLs as forward slashes, which can turn this into a scheme-relative external navigation target. In addition, the generated href concatenated the reconstructed URL with the original URL, increasing the possibility of unsafe or malformed link generation. An attacker able to configure or influence a dashboard button URL could craft a button that appears to point inside the application but redirects users to an attacker-controlled site when clicked. This could be used for phishing, credential theft, or social engineering. The patch fixes the issue by rejecting empty paths and paths starting with /\, and by emitting only the reconstructed validated URL in the anchor href.

CWE(s)
CWE-601

Related Threats

MITRE ATT&CK Enterprise Techniques

MITRE ATT&CK v20.0

T1056 Input Capture Collection
Adversaries may use methods of capturing user input to obtain credentials or collect information.
attack.mitre.org →
T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1204 User Execution Execution
An adversary may rely upon specific actions by a user in order to gain execution.
attack.mitre.org →
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
attack.mitre.org →
T1534 Internal Spearphishing Lateral Movement
After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization.
attack.mitre.org →
T1566 Phishing Initial Access
Adversaries may send phishing messages to gain access to victim systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-10861Same product: Misp-Project Misp
CVE-2023-37306Same product: Misp-Project Misp
CVE-2026-86452Same product: Misp-Project Misp
CVE-2026-85237Same product: Misp-Project Misp
CVE-2026-56447Same product: Misp-Project Misp
CVE-2026-85221Same product: Misp-Project Misp
CVE-2026-85236Same product: Misp-Project Misp
CVE-2026-9136Same product: Misp-Project Misp
CVE-2026-85238Same product: Misp-Project Misp
CVE-2026-56425Same product: Misp-Project Misp

Affected Assets

misp-project
misp
≤ 2.5.39

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.7.2

Mitigating Controls (NIST 800-53 r5)

Our mappings, made for this CVE.

SI-10 Information Input Validation good match

Input validation directly checks and rejects untrusted redirect targets before they are used in a response.

AC-4 Information Flow Enforcement partial match

Information flow enforcement can restrict redirects to only approved/trusted destinations, stopping untrusted user-supplied URLs from being followed.

Mitigating Controls (NIST CSF 2.0)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly require input validation and untrusted-redirect controls that prevent CWE-601.

References