Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-44364misp-modules website - Missing CSRF protection in the website home blueprint

Critical 9.3

In plain English

A critical-severity cross-site request forgery in misp-modules from MISP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.2%top 91.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	misp-modules	no fix listed	GHSA-j4rh-7jcr-qm69
PyPI	misp-modules	no fix listed	PYSEC-2026-414

Affected products (as reported)

Vendor	Product	Versions
MISP	misp-modules	<= 3.0.7

Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H

References

https://github.com/MISP/misp-modules/security/advisories/GHSA-j4rh-7jcr-qm69 x_refsource_CONFIRM