CVE-2026-104901

Executive Summary

CVE-2026-104901 is a stored/reflected cross-site scripting (XSS) vulnerability in the ID Translator feature of MISP (Malware Information Sharing Platform) affecting versions prior to 2.5.48. The flaw occurs because an event identifier returned by a linked (remote) MISP server is rendered in the host instance's HTML output without proper output encoding when an authenticated user views the ID Translator page. A malicious or compromised linked server can inject arbitrary HTML or JavaScript that executes in the browser of any authenticated user of the host organization who navigates to that page, enabling session hijacking, credential theft, or other client-side attacks.

Technical Analysis

MISP is an open-source threat intelligence sharing platform that federates with other MISP instances ("linked servers"). The ID Translator feature is designed to resolve local event identifiers against corresponding identifiers on linked remote instances: when a user opens the ID Translator page for a given event, the host instance issues a query to each configured linked server and receives back the remote event's identifier for display.

CVE-2026-104901 is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting). The NVD description states that the event ID returned by the remote server "was rendered in the HTML output without proper output encoding." This means the trust boundary is broken at the federation layer: the host instance treats a value supplied by a remote, potentially untrusted peer as safe display content and emits it directly into the HTML response.

Two properties define the exploitation model:

1. Attacker-controlled input source. The malicious payload originates from a linked MISP server. An adversary who operates, controls, or has compromised a federated instance that the victim host has configured as a linked server can cause the remote server to respond with a crafted event ID string containing arbitrary HTML or JavaScript markup. No authentication on the host instance is required of the attacker; the attacker only needs to control the remote instance and induce a victim to view the affected page.

2. Victim-triggered rendering. The script executes in the origin/security context of the host MISP instance when an authenticated host user views the ID Translator page for the relevant event. Because the markup is injected into the trusted origin, it is not subject to cross-origin restrictions and can act with the victim's authenticated privileges.

The exact encoding routine, template path, function names, and API parameters are not specified in the available NVD description or CNA title. The vulnerability class (lack of output encoding of a remote-supplied identifier before HTML rendering) is unambiguous, but no code-level identifier can be asserted without fabricating detail not present in the source data. Affected versions are stated as < 2.5.48.

Exploitation Scenarios

The following attack chain is derived strictly from the NVD description and vulnerability class. No public PoC, exploit code, or Nuclei template is available; the chain is inferred from the XSS class and the stated federation trigger.

1. Reconnaissance / target identification. The adversary identifies a host MISP instance that (a) is version < 2.5.48 and (b) has configured the attacker's server as a linked server. Linked-server relationships are inherent to MISP federation and are often established between partner organizations, so the adversary may either be a legitimate federation partner, an operator of a compromised partner instance, or an attacker who has gained control of a federated node.

2. Triggering the flaw class. The ID Translator page on the host instance queries linked servers for corresponding event identifiers. The adversary configures or manipulates the linked server so that the event ID it returns for the queried event contains arbitrary HTML or JavaScript markup, rather than a benign identifier.

3. Payload / execution method. Because the returned event ID is rendered in the host instance's HTML output without proper output encoding, the injected markup is emitted into the page in the host origin. When an authenticated host user navigates to the ID Translator page for that event, the browser parses and executes the injected script under the host instance's session context. At the vulnerability-class level, the payload can be any client-side script capable of actions available to the victim's session.

4. Post-exploitation impact. Per the NVD description, consequences include session hijacking, credential theft, and other client-side attacks. Script executing in the host origin can read the victim's authenticated session context and act on the victim's behalf within the MISP application. Because affected users are authenticated host users who may hold elevated threat-intelligence privileges, the blast radius can extend to sensitive event, attribute, and indicator data accessible through the victim's account.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

The vulnerability is a cross-site scripting condition with the following characteristics, based on the assigned CWE and the NVD description:

• Confidentiality (C:L): The primary documented impact is client-side — session hijacking and credential theft affecting authenticated host users. This can expose the victim's session and the data visible to that account.
• Integrity (I:L): Injected script executes in the host origin and can perform actions within the application as the victim, including modifying data reachable by the victim's account.
• Availability (A:N): No direct availability impact is described.
• Scope (S:C): The injected content is rendered in the host MISP origin, so the security impact crosses from the remote-server boundary into the host application's security context.
• Attack Vector (AV:N): The attack is delivered over the network via federated server responses.
• Attack Complexity (AC:L): No special conditions beyond controlling a linked server and inducing a page view.
• Privileges Required (PR:N): The attacker does not need credentials on the host instance; the preconditions are on the victim side (authenticated user navigating to the page).
• User Interaction (UI:R): A user must navigate to the ID Translator page.

No CVSS score or vector was supplied with the CVE data (CVSS Score: N/A; Vector: N/A); the vector above is an analytical estimate consistent with the CWE and NVD description and should not be treated as an authoritative assigned score. EPSS has not yet been scored by FIRST.org, and the CVE is not listed in CISA KEV.

Affected systems: MISP instances running versions < 2.5.48 that have at least one linked server configured. Blast radius: Any authenticated host user who views the ID Translator page for an event whose remote identifier is attacker-controlled. Because MISP is used for threat intelligence sharing across organizations, compromised sessions can expose or manipulate shared intelligence.

Detection Guidance

Sigma Rule

title: MISP ID Translator Cross-Site Scripting Attempt via Linked Server Response
id: 9f3c1a72-4b2e-4d81-9a6f-2c7d5e10b4aa
status: experimental
description: Detects HTML/JavaScript markup embedded in event identifiers returned during ID Translator lookups on MISP instances (CVE-2026-104901).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104901
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: misp
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'id_translator'
      - 'idTranslator'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'javascript:'
      - '<img'
      - '%3Cimg'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate encoding of benign identifiers that include angle brackets (unlikely in event IDs)
level: high

YARA Rule

rule CVE_2026_104901_MISP_IDTranslator_XSS
{
    meta:
        description = "Detects HTML/JavaScript markup in MISP event identifier values associated with ID Translator XSS (CVE-2026-104901)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104901"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $evt = "event_id" nocase
        $tag1 = "<script" nocase
        $tag2 = "</script>" nocase
        $tag3 = "javascript:" nocase
        $tag4 = "onerror=" nocase
        $tag5 = "onload=" nocase
        $tag6 = "<img" nocase
        $tag7 = "<svg" nocase
        $tag8 = "document.cookie" nocase

    condition:
        $evt and any of ($tag*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104901 MISP ID Translator XSS via linked server response"; flow:established,to_client; http.response_body; content:"event_id"; nocase; http.response_body; pcre:"/(<script|javascript:|onerror\s*=|onload\s*=|<svg|<img[^>]+src\s*=)/i"; reference:cve,2026-104901; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104901; classtype:web-application-attack; sid:2026104901; rev:1;)

Elastic Detection

network where
  event.category == "network" and
  http.response.status_code == 200 and
  /* MISP ID Translator response containing unencoded event identifier markup across a linked-server federation response */
  http.response.body : ("event_id") and
  (
    http.response.body : ("<script") or
    http.response.body : ("javascript:") or
    http.response.body : ("onerror=") or
    http.response.body : ("onload=") or
    http.response.body : ("<svg") or
    http.response.body : ("<img")
  )

Splunk SPL Query

index=web sourcetype=misp:access OR sourcetype=apache:access
| search uri_path="*id_translator*" OR uri_path="*idTranslator*"
| eval suspicious=if(match(uri_query, "(?i)(%3Cscript|<script|javascript:|onerror=|onload=|%3Cimg|<img|%3Csvg|<svg)") OR match(_raw, "(?i)(<script|javascript:|onerror=|onload=)"), 1, 0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query, status
| sort - count

Wazuh OSSEC Rule

<group name="misp,xss,cve-2026-104901,">
  <rule id="2026101" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>id_translator|idTranslator</url>
    <regex match="(%3Cscript|<script|javascript:|onerror=|onload=|%3Cimg|<img|%3Csvg|<svg)" type="pcre2">(?i)(&lt;script|&lt;svg|&lt;img|javascript:|onerror=|onload=)</regex>
    <description>CVE-2026-104901: Possible MISP ID Translator XSS - markup in event identifier query</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>web,appsec,attack,</group>
  </rule>
  <rule id="2026102" level="12">
    <if_sid>2026101</if_sid>
    <description>CVE-2026-104901: Confirmed pattern of unencoded markup in MISP ID Translator response</description>
    <group>web,appsec,attack,critical,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or official workaround is recorded in the available data. The affected version range is < 2.5.48; no confirming patch release is identified, so the following are defensive measures only.

1. Immediate mitigations

   • Reduce linked-server trust surface. Audit configured linked (remote) MISP servers. Disable or remove federation links to instances that are not strictly trusted, since the attack requires a malicious or compromised linked server. Where operationally feasible, limit which peers can be queried by the ID Translator feature.
   • Restrict access to the ID Translator page. Limit the set of authenticated users who can reach the ID Translator feature to reduce the population of potential victims via role-based access controls and network segmentation.
   • Enforce a strong Content-Security-Policy. Deploy a CSP on the MISP instance that disallows inline script execution (script-src 'self' and avoiding unsafe-inline), which constrains the impact of injected markup that reaches the browser.
   • Harden the session cookie. Ensure session cookies are set with HttpOnly and Secure flags to reduce the impact of successful script execution (note: HttpOnly does not prevent all client-side actions such as authenticated request forgery, but limits direct cookie theft).

2. Patch / upgrade steps

   • Monitor the official MISP project release channels and vendor advisories for a release addressing CVE-2026-104901 and the stated affected range (< 2.5.48). As of this report, no patch or fixed version is confirmed.
   • When a fix is published, upgrade MISP to the recommended fixed version and re-validate all linked-server configurations.
   • Apply the principle of least privilege to federation: only linked servers that are operationally necessary should remain configured.

3. Long-term hardening

   • Enforce context-aware output encoding of all data returned from linked/federated servers before rendering, treating remote identifiers as untrusted input.
   • Adopt a defense-in-depth posture for the federation layer: input validation on remote responses, schema/type constraints on expected identifier values, and consistent output encoding in templates.
   • Establish a routine for reviewing and re-attesting federated partners, and monitor for anomalies in responses from linked servers.

References

• NVD — CVE-2026-104901: https://nvd.nist.gov/vuln/detail/CVE-2026-104901
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• MISP Project (official project site and release notes; monitor for an advisory addressing CVE-2026-104901 and versions < 2.5.48): https://www.misp-project.org/
• FIRST EPSS — scoring status for CVE-2026-104901 (not yet scored as of this report): https://api.first.org/data/v1/epss?cve=CVE-2026-104901

No public exploit, PoC, Nuclei template, or exploit-in-the-wild evidence is available for CVE-2026-104901. The CVE is not listed in CISA KEV, and no threat actor campaign has been attributed to this vulnerability in the available data.