Is there a patch available for CVE-2026-44379?

Yes, a patch is available for CVE-2026-44379. Update the affected software to the latest version immediately.

MISP CVE-2026-44379

Q: What is the CVSS score of CVE-2026-44379?

CVE-2026-44379 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-30166 MEDIUM

Improper Input Validation (CWE-20)

2026-05-13 GitHub_M

Information Disclosure Misp

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 11:18 vuln.today

Analysis Generated

Jun 08, 2026 - 11:18 vuln.today

Patch available

May 13, 2026 - 22:03 EUVD

CVSS changed

May 13, 2026 - 21:22 NVD

5.3 (MEDIUM)

DescriptionCVE.org

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field. As a result, a user able to create or modify Collection records could submit malformed UUID values, potentially causing integrity issues or unexpected behaviour in code paths that assume Collection UUIDs are valid identifiers. This vulnerability is fixed in 2.5.37.

AnalysisAI

Insufficient input validation in MISP's Collections model allows authenticated low-privileged users to inject malformed UUID values into Collection records, potentially causing data integrity issues or unexpected behavior in downstream code paths that assume RFC 4122-compliant UUIDs. Affected deployments are all MISP instances prior to version 2.5.37. No public exploit code exists and CISA's SSVC framework rates exploitation as none, making this a low-urgency integrity issue rather than an active threat, though integrity of Collection relationships and UUID-dependent logic is at risk until patched.

Technical ContextAI

MISP (Malware Information Sharing Platform) is a CakePHP-based threat intelligence platform. The vulnerability resides in app/Model/Collection.php, where the Collection model's uuid field lacked a CakePHP model-level validation rule enforcing RFC 4122 UUID format. CWE-20 (Improper Input Validation) identifies the root cause: the application accepted user-controlled input without constraining it to the expected UUID format. The fix, visible in commit f8b20358c3cd8fd3d784452901876f2db0acbf05, adds a $validate array to the Collection model with CakePHP's built-in 'uuid' rule. Any MISP instance matching CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* and running a version below 2.5.37 is affected.

RemediationAI

Upgrade MISP to version 2.5.37 or later, which introduces RFC 4122 UUID validation in the Collection model via the fix committed at https://github.com/MISP/MISP/commit/f8b20358c3cd8fd3d784452901876f2db0acbf05. If an immediate upgrade is not feasible, restrict Collection create and modify permissions to highly trusted users or administrators only through MISP's role-based access control, reducing the pool of accounts that could submit malformed UUIDs. This access restriction does not fully eliminate the vulnerability but limits the attack surface to privileged accounts. The full vendor advisory is at https://github.com/MISP/MISP/security/advisories/GHSA-jrvj-84mg-8f29.