# Multiple vulnerabilities in MISP threat platform

Published: 2026-04-30 · Severity: elevated · Sectors: defense, government-national, technology
Canonical: https://vorant.io/reports/6ca4a2c5-34f5-5701-9c96-cb7ff6543f87/multiple-vulnerabilities-in-misp-threat-platform

> Six vulnerabilities in MISP before version 2.5.37 allow privilege escalation, SQL injection, and security policy bypass.

CERT-FR advisory documents multiple critical vulnerabilities affecting MISP, a widely-used open-source threat intelligence platform. The affected versions are all releases prior to 2.5.37. The vulnerabilities enable attackers to escalate privileges within the platform, execute arbitrary SQL queries through injection attacks, and bypass security policies that govern access control. Organizations operating MISP for threat data collection, analysis, and sharing must update immediately to version 2.5.37 or later to remediate these issues. The advisory references the vendor's own security bulletin dated 30 April 2026 for patching and remediation details.

## Mentioned in this report

- Vulnerabilities: CVE-2026-39962, CVE-2026-44379, CVE-2026-44380, CVE-2026-44381 (templated), CVE-2026-9136, CVE-2026-9137

## Detection guidance (public sample)

### SQL Injection Patterns in Requests to MISP Application Paths

ATT&CK: T1190

Detects SQL injection keywords and functions in the query string of web requests to common MISP endpoints, which could indicate exploitation of the MISP SQLi flaws fixed in 2.5.37. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Injection Patterns in Requests to MISP Application Paths
description: Detects SQL injection syntax (UNION SELECT, time-based and error-based
  functions, information_schema access) in the URI query of requests to typical MISP
  controller paths. Targets MISP releases before 2.5.37. Path matching is generic
  to MISP routing and not tied to a specific exploit artefact. Tune the paths to your
  deployment.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
    - /events/
    - /attributes/
    - /objects/
    - /users/
    - /organisations/
    - /servers/
    - /sightings/
    - /galaxies/
    - /tags/
    - /taxonomies/
    - /warninglists/
  selection_sqli:
    cs-uri-query|contains:
    - union select
    - union%20select
    - union+select
    - union all select
    - information_schema
    - sleep(
    - sleep%28
    - benchmark(
    - extractvalue(
    - updatexml(
    - waitfor delay
    - waitfor%20delay
    - ''' or ''1''=''1'
    - '%27%20or%20%271%27%3D%271'
  condition: selection_path and selection_sqli
falsepositives:
- Authorised vulnerability scanners or penetration tests against the MISP instance
- Legitimate MISP searches whose free-text value contains SQL keywords, such as threat
  reports quoting SQLi payloads
level: medium
id: ae026b56-9726-553d-bdf7-b6533d10185d
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0515
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0515

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6ca4a2c5-34f5-5701-9c96-cb7ff6543f87/multiple-vulnerabilities-in-misp-threat-platform.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup