CVE-2026-10856: MISP Dashboard URL Validation Bypass – Phishing Risk

Technical summary

CVE-2026-10856 is a URL validation bypass in MISP's dashboard button widget functionality. The validation logic rejects URLs containing explicit schemes, hosts, or user components, but fails to properly handle paths beginning with forward slash followed by backslash (e.g., /\example.com). Browser URL normalization converts backslashes to forward slashes in certain contexts, transforming these paths into scheme-relative external navigation targets (//example.com). Additionally, the vulnerable code concatenates the reconstructed URL with the original input when generating the anchor href attribute, compounding the risk of malformed or unsafe link generation. The patch addresses this by rejecting empty paths and paths starting with /\, and by using only the validated reconstructed URL in the href attribute.

Business impact

Dashboard button manipulation could be weaponized for credential harvesting and phishing attacks against MISP users. Since MISP is typically deployed in threat intelligence operations centers as a central intelligence platform, compromised dashboard buttons could target security analysts and incident responders—users likely to handle sensitive credentials. The attack requires no user agent exploitation; it relies on social engineering and trust in the application interface. Organizations using MISP for collaborative threat sharing may face secondary risk if attackers use compromised instances to distribute malicious buttons across federated networks.

Affected systems

This vulnerability affects MISP (Malware Information Sharing Platform) instances where users have the ability to configure or create dashboard buttons. The vulnerability is in the misp-project/misp product line. Organizations running MISP deployments should audit dashboard button configurations, particularly those created by users with administrative or dashboard editing privileges. The issue does not require MISP to be exposed to the internet; it can be exploited by any user with dashboard modification access, including internal users or compromised accounts.

Exploitability

Exploitation requires either direct dashboard configuration access or the ability to influence button URL settings through a stored XSS, account compromise, or API manipulation. The attack itself is trivial once a crafted URL is injected—users need only click the button. No special browser configuration or user interaction beyond normal clicking is required. The barrier to initial exploitation is access to dashboard configuration; the barrier to successful attack is social engineering users into clicking a button that appears legitimate because it is housed within the trusted application interface.

Remediation

Apply the patch that fixes URL validation by rejecting empty paths and paths beginning with /\, and by ensuring only the validated reconstructed URL is used in the href attribute. Organizations should also audit existing dashboard buttons for suspicious URLs, particularly those created recently or by privileged users. Restrict dashboard button creation permissions to trusted administrators where possible, and consider implementing approval workflows for button additions in multi-user deployments.

Patch guidance

Upgrade MISP to a version that includes the fix for CVE-2026-10856. Consult the MISP project advisory and release notes to identify the patched version number. After patching, review and re-validate all existing dashboard buttons, especially those pointing to internal paths or created by administrative users. Test button functionality in multiple browsers to confirm the fix does not break legitimate internal navigation.

Detection guidance

Monitor MISP dashboard configuration changes for URLs containing backslash characters, paths starting with forward slash-backslash sequences, or unusual URL patterns deviating from normal internal link conventions. Review audit logs for modifications to dashboard buttons and cross-reference timestamps with user activity. In network-based detection, look for MISP users navigating to unexpected external domains immediately after clicking dashboard buttons. Behavioral indicators include users being redirected from MISP to phishing domains or credential-harvesting sites referenced in browser history.

Why prioritize this

Although CVSS 6.1 rates this as MEDIUM severity, the attack surface is broad—any user with dashboard access is a potential attacker, and any MISP user is a potential target. The social engineering component is high-impact because users expect links in the application interface to be safe. Prioritize patching if your MISP instance allows untrusted or semi-trusted users to create dashboard buttons, or if it is part of a federated threat intelligence network where compromised instances could propagate malicious buttons. Organizations with strict dashboard administration controls can deprioritize slightly but should still patch within normal maintenance windows.

Risk score, explained

CVSS 6.1 (MEDIUM) reflects the requirement for user interaction (button click) and the need for prior access to dashboard configuration. The network-accessible attack vector and scope change (affecting users beyond the compromised component) elevate the score. Integrity and confidentiality impacts are both low because the attack enables phishing and redirection rather than direct data exfiltration or modification. The absence of CVSS availability impact and the conditional nature of exploitation (requires user click and social engineering) prevent a higher rating, though real-world impact can exceed the numeric score if targeting high-value users.

Frequently asked questions