MISP CVE-2026-95679

Exploitable when the MISP cspReport endpoint is network-reachable by the attacker (it is unauthenticated by design and accepts an XML content type) AND the MISP server itself has network access to the internal or external HTTPS target the attacker wishes to reach. Trigger is a POST write request whose XML body is a bare HTTPS URL, which Xml::build()'s miswritten guard (readFile && http || https) fetches. Limiting factors: the SSRF is BLIND (VC:L, no response body returned to the attacker), so it enables probing/timing recon and triggering GET-style internal actions rather than data exfiltration; usefulness depends on the server having reachable sensitive internal HTTPS services. Only the HTTPS scheme is affected by the precedence bug per the description. No authentication, no user interaction, and no non-default configuration are required (PR:N/UI:N).

CVSS 4.0 rates this 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and impact VC:L only - a genuinely unauthenticated, low-complexity network attack, but with strictly limited confidentiality impact and no integrity or availability impact, consistent with a BLIND SSRF (the attacker cannot read the response body). CWE-918 and the SSRF tag align with the technical description. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is 'no public exploit identified at time of analysis' - there is no evidence of active or automated exploitation. The primary risk driver is the unauthenticated reachability of the cspReport endpoint by design, which lowers the barrier versus authenticated MISP flaws; however, the blind nature caps direct data theft, making the realistic impact internal-network reconnaissance/probing and triggering GET-style actions on internal HTTPS endpoints rather than full data exfiltration. This is a real-but-moderate priority: the low CVSS impact metrics and absence of KEV/EPSS/POC signals argue against an emergency, while the unauthenticated network vector and 'near-default' preconditions argue for prompt patching, especially where MISP has line-of-sight to sensitive internal HTTPS services or cloud metadata endpoints. All key signals (vector, CWE, patch, source-code evidence) are internally consistent; no conflicting data was observed.

An unauthenticated attacker sends a POST request to the MISP cspReport endpoint with an XML content type and a body consisting of a bare HTTPS URL pointing at an internal service (e.g. https://10.0.0.5/admin or a cloud metadata endpoint). MISP's RequestHandlerComponent decodes the body via the flawed Xml::build() guard and the server issues an outbound HTTPS request to that target, letting the attacker map reachable internal hosts or trigger internal HTTPS actions. No public exploit code was provided, but the low attack complexity (AC:L) and lack of authentication (PR:N) make weaponization straightforward.