Which versions of MISP are affected by CVE-2026-44381?

MISP threat intelligence platform versions below 2.5.37 contain a critical SQL injection vulnerability allowing unauthenticated attackers to manipulate threat intelligence data, potentially exposing…. A patch is available.

Is there a public PoC exploit available for CVE-2026-44381?

Yes, a public proof-of-concept exploit is available for CVE-2026-44381. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-44381?

Within 24 hours: Audit all MISP deployments and document current versions. Within 7 days: Upgrade all instances to MISP 2.5.37 or later. Within 30 days: Verify all upgrades are complete, review audit logs for potential exploitation attempts, and conduct security assessment of threat intelligence datasets for signs of tampering.

MISP CVE-2026-44381

Q: What is the CVSS score of CVE-2026-44381?

CVE-2026-44381 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30168 CRITICAL

SQL Injection (CWE-89)

2026-05-13 GitHub_M

Authentication Bypass SQLi Misp

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:28 vuln.today

Patch available

May 13, 2026 - 22:03 EUVD

CVSS changed

May 13, 2026 - 21:22 NVD

9.3 (CRITICAL)

DescriptionCVE.org

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted order or sort values from request parameters and incorporated them into database query ordering clauses without sufficient validation of the requested field name. An attacker with access to the affected endpoints could craft a malicious ordering parameter to manipulate the generated SQL query. Depending on database permissions and query context, this could potentially allow unauthorized access to data, modification of query behavior, or other database-level impact. This vulnerability is fixed in 2.5.37.

AnalysisAI

SQL injection in MISP threat intelligence platform versions prior to 2.5.37 allows remote unauthenticated attackers to manipulate ORDER BY clauses in event and shadow attribute listing endpoints by supplying crafted ordering parameters. The CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability, though EPSS exploitation probability sits at just 0.04% and no public exploit identified at time of analysis. Given MISP's role as a repository of sensitive threat-intelligence data shared between organizations, successful exploitation could expose IOCs, attribution data, and partner-shared intelligence.

Technical ContextAI

MISP (Malware Information Sharing Platform) is a widely deployed open-source threat intelligence platform written in PHP on the CakePHP framework, used by CSIRTs, CERTs, and security teams to share structured indicators of compromise. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically in handling of user-controllable sort/order request parameters that were interpolated into SQL ORDER BY clauses without adequate validation against an allow-list of permitted column names. ORDER BY injection is a well-known sub-class of SQLi that cannot be remediated by parameterized queries alone - column identifiers must be validated against a whitelist because they cannot be bound as parameters. The vulnerability resides in the event and shadow attribute listing endpoints, which are core data-retrieval functions of the platform.

RemediationAI

Upgrade to MISP 2.5.37 or later, which is the vendor-released patch containing the fix per the GHSA-4cxp-22wm-j6jr advisory. Operators unable to upgrade immediately should restrict network access to MISP web endpoints to trusted analyst IP ranges via firewall or reverse-proxy ACLs, require strong authentication on all listing endpoints, and review database account permissions so the MISP application user has only the minimum privileges required (no DROP, FILE, or cross-database access) to limit blast radius of any residual injection. Web Application Firewall rules blocking suspicious ORDER BY / sort parameter values containing SQL metacharacters (parentheses, comma chains, UNION, sleep functions, comments) can provide interim coverage but are bypassable and should not substitute for the upgrade. Review MISP application and database logs for unusual query patterns or errors on event and shadow attribute endpoints prior to patching.