MISP CVE-2026-106513

Exploitation requires all of the following concrete preconditions: (1) a valid site-admin account whose session has been hijacked via a separate mechanism such as stored XSS; (2) the attacker using that session to modify the Redis host settings for the core application, the ZeroMQ plugin, and/or the SimpleBackgroundJobs plugin through the web UI or API; (3) the ability to restart the background job workers so they reconnect to the attacker-controlled Redis server; and (4) an attacker-operated Redis instance serving crafted job payloads that the workers execute without validation. Limiting factors: it is NOT remotely exploitable without authentication (site-admin required), it depends on a prior session-compromise/XSS primitive the attacker does not inherently control (hence high complexity), and the fixed version removes these settings from the UI/API entirely by making them CLI-only.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 4.0 base score is 6.9 (Medium), and the vector itself tells the story: AV:N makes it network-reachable, but PR:H requires site-admin privileges and AC:H reflects the need for a separate prerequisite (a hijacked site-admin session, e.g. via stored XSS). VI:H and SI:H capture the integrity/RCE impact, while VC:N/VA:N indicate the official scoring did not credit direct confidentiality or availability loss - this conflicts somewhat with the description, which explicitly mentions 'potential data exfiltration through the attacker-controlled Redis connection,' so a confidentiality impact is plausible and arguably under-scored. No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is 'no public exploit identified at time of analysis' - not active exploitation. The practical risk is bounded by the fact that an attacker must already hold a site-admin session, meaning this is best treated as a privilege-escalation / post-compromise RCE primitive that chains onto a separate web-app flaw (XSS/session hijack) rather than a standalone remote entry point. Priority should be driven by whether the deploying organization has mitigated the XSS/session-hijack precursor; the fix (making the Redis settings CLI-only) is confirmed available in the referenced commit, so patching is straightforward.

An attacker first compromises a site-admin's authenticated session (for example by landing a stored XSS payload in the MISP UI), then uses that session to rewrite the core/ZeroMQ/SimpleBackgroundJobs Redis host settings to point at a Redis server they control and restarts the background workers. When the workers reconnect and pull raw, unvalidated job payloads from the malicious Redis instance, the attacker's crafted payloads are executed as the worker account, yielding arbitrary command execution. No public exploit code was identified in the provided data; the high attack complexity reflects the required prior session compromise.