CVE-2026-106513

Executive Summary

CVE-2026-106513 is an improper access control vulnerability (CWE-284) in MISP that exposes critical infrastructure settings—including the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—to site-admin users through the web UI and API. Because background job workers trust raw Redis job payloads without additional validation, an attacker who hijacks a site-admin session can redirect workers to an attacker-controlled Redis server and inject malicious job payloads that execute as the worker account, achieving remote code execution. The vulnerability requires site-admin privileges and a prior session-compromise mechanism (for example, stored XSS); it does not permit unauthenticated access.

Technical Analysis

The core weakness is an access-control failure (CWE-284) in which MISP surfaces sensitive infrastructure configuration to site-admin users via the web UI and API. Specifically, the NVD description states that the Redis host addresses for three components are exposed and modifiable through this interface:

• The core application's Redis host setting
• The ZeroMQ plugin's Redis host setting
• The SimpleBackgroundJobs plugin's Redis host setting

Exposure alone would be a configuration-hygiene issue, but the description identifies a second, decisive condition: "The background job workers trust raw Redis job payloads without additional validation." This means the worker processes treat any payload retrieved from their configured Redis endpoint as a legitimate job. There is no integrity control, signature verification, or origin validation on the job queue described.

Chaining these two properties produces the exploit primitive. A site-admin session—obtained through a separate compromise such as a stored cross-site scripting (XSS) flaw—can reach the settings interface and rewrite the Redis host values to point at an attacker-controlled Redis instance. Restarting the workers causes them to connect to the attacker's Redis server. The attacker then publishes crafted job payloads onto that queue, and the workers execute them. The description explicitly states this achieves "arbitrary command execution as the worker account."

A secondary issue is also documented: the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface. A hijacked session could re-enable this feature, "allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks." This lowers the bar for follow-on exploitation against other MISP users.

The attack surface is the MISP web UI and API endpoints that render and update instance settings for site-admin accounts. The relevant functional components named in the description are the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin. No specific file paths, function names, route strings, or parameter names beyond the three Redis host settings and download_attachments_on_load are provided in the source data, and none are asserted here. Note that the required privilege level is high (site-admin) and the attack depends on a precondition chain (session theft), which is why the vector we derive carries AC:H and PR:H despite the severe downstream impact.

Exploitation Scenarios

The following chain is derived strictly from the NVD description. No public proof-of-concept, Nuclei template, or exploit code is known to exist for this CVE; the sequence below is inferred from the described vulnerability class and stated preconditions.

1. Reconnaissance / target identification. An attacker identifies a MISP instance and enumerates its web UI and API. The attacker needs a site-admin account or, more realistically, a means to hijack a site-admin session.

2. Session compromise (precondition). The description states the vulnerability "requires site-admin privileges and a prior session-compromise mechanism; for example, through a stored cross-site scripting vulnerability." The attacker therefore first obtains a hijacked site-admin session—this could be via stored XSS in MISP or any other mechanism that yields an authenticated site-admin session. This is explicitly a precondition, not part of the CVE itself.

3. Settings manipulation (the access-control flaw). Using the hijacked site-admin session, the attacker accesses the settings interface exposed through the MISP web UI and API and modifies the Redis host addresses for the core application, the ZeroMQ plugin, and/or the SimpleBackgroundJobs plugin so they point at an attacker-controlled Redis server. Optionally, the attacker also re-enables download_attachments_on_load through the same interface to facilitate follow-on client-side attacks against other users.

4. Worker redirection and payload injection. The attacker restarts the background job workers. The workers connect to the attacker-controlled Redis instance. Because the workers "trust raw Redis job payloads without additional validation," the attacker writes malicious job payloads to the queue. The worker processes execute those payloads.

5. Post-exploitation impact. The description states the outcome is "arbitrary command execution as the worker account" plus "potential data exfiltration through the attacker-controlled Redis connection." Because the workers now communicate with the attacker's Redis server, data that transits that channel—job data and anything else the workers stage through Redis—is exposed to the attacker. With code execution as the worker account, the attacker can pivot within the MISP host, read data the worker can access, and potentially move laterally depending on deployment architecture.

No public exploit code is available and none is fabricated here. The mechanism-level chain above is the complete picture supported by the provided data.

Impact Assessment

The impact is severe at the post-exploitation stage but constrained by two meaningful preconditions: site-admin privileges and a prior session-compromise mechanism. Unauthenticated attackers cannot trigger this directly, and there is no evidence of exploit-in-the-wild activity, CISA KEV listing, or public proof-of-concept at the time of writing. EPSS has not scored this vulnerability, and no CVSS score or vector is assigned by the authoritative source; the vector in the metadata block above is an analyst-derived estimate consistent with the described mechanism (network-reachable, high privilege required, high attack complexity due to the session-theft precondition, scope change because worker execution crosses from web application into host command execution, high confidentiality and integrity impact, high availability impact given arbitrary command execution).

Key impact dimensions:

• Confidentiality (High): Arbitrary command execution as the worker account plus exfiltration through the attacker-controlled Redis connection. MISP instances routinely hold sensitive threat intelligence, indicators, and sharing-group data; the worker account's accessible data is exposed.
• Integrity (High): Attackers can inject arbitrary jobs and execute commands, and can alter persisted settings (Redis host addresses, download_attachments_on_load).
• Availability (High): Workers can be disrupted by defaulting them to an unreachable or attacker-held Redis backend; malicious jobs may also crash or consume worker resources.
• Scope (Changed): The web application's settings interface is the entry point, but the impact manifests in the worker process and underlying host—outside the original security authority of the web request.

Blast radius considerations: MISP is frequently deployed as a shared threat-intelligence platform in SOCs, CERTs, ISACs, and government environments. A compromised worker on such an instance can expose intelligence data across sharing communities, making the business impact disproportionate to the worker process's own privileges. Because the exploit requires only configuration changes plus a worker restart, it is repeatable and low-effort once a site-admin session is held.

Detection Guidance

Sigma Rule

title: MISP Redis Host Setting Modification via Web UI or API
id: 7f3a9c12-4b8e-4d21-9c77-1e5a2f6b8d03
status: experimental
description: Detects changes to MISP Redis host configuration settings (core, ZeroMQ, SimpleBackgroundJobs) or re-enabling of download_attachments_on_load, which may indicate CVE-2026-106513 exploitation via a hijacked site-admin session.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106513
author: valtersit.com threat intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.persistence
  - cve.2026.106513
logsource:
  category: webserver
  product: misp
detection:
  selection_paths:
    - '/servers/editSettings'
    - '/admin/settings'
    - '/api/v1/servers/editSettings'
  selection_keywords:
    - 'redis_host'
    - 'Redis.host'
    - 'SimpleBackgroundJobs'
    - 'ZeroMQ'
    - 'download_attachments_on_load'
  condition: selection_paths and selection_keywords
falsepositives:
  - Legitimate site-admin reconfiguration of Redis backend during migration
level: high

YARA Rule

rule CVE_2026_106513_MISP_Redis_Setting_Abuse
{
    meta:
        description = "Detects HTTP request bodies or MISP log entries referencing Redis host setting changes tied to CVE-2026-106513 exploitation"
        author = "valtersit.com threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106513"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "Redis.host" ascii wide nocase
        $s2 = "redis_host" ascii wide nocase
        $s3 = "SimpleBackgroundJobs" ascii wide nocase
        $s4 = "ZeroMQ" ascii wide nocase
        $s5 = "download_attachments_on_load" ascii wide nocase
        $s6 = "editSettings" ascii wide nocase

    condition:
        uint16(0) == 0x4854 or
        (2 of ($s1, $s2, $s3, $s4, $s5, $s6))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106513 MISP Redis Host Setting Modification Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"settings"; http.request_body; content:"redis"; nocase; http.request_body; content:"host"; nocase; reference:cve,2026-106513; classtype:attempted-admin; sid:2026106513; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [http where http.request.method == "POST" and
   wildcard(http.request.body.text, "*redis*host*")]
  [process where event.action in ("start", "restart") and
   wildcard(process.command_line, "*SimpleBackgroundJobs*")]

Splunk SPL Query

index=web OR index=misp
| search (uri_path="*/settings*" OR uri_path="*/editSettings*")
| search (request_body="*redis*" OR request_body="*Redis.host*" OR request_body="*download_attachments_on_load*" OR request_body="*SimpleBackgroundJobs*")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(src_ip) as source_ips by user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="misp,cve-2026-106513,">
  <rule id="1065130" level="12">
    <decoded_as>json</decoded_as>
    <field name="uri_path">\.?/.*(settings|editSettings).*</field>
    <field name="request_body">redis|Redis\.host|SimpleBackgroundJobs|download_attachments_on_load</field>
    <description>CVE-2026-106513: MISP Redis host or attachment rendering setting modified - possible site-admin session abuse</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="1065131" level="10">
    <decoded_as>json</decoded_as>
    <field name="service">SimpleBackgroundJobs</field>
    <field name="action">start|restart</field>
    <description>CVE-2026-106513: MISP background job worker restart following Redis settings change</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data is available. The following guidance is defensive-in-depth and does not rely on a vendor patch.

1. Immediate mitigations.

   • Break the session-hijack precondition: audit and remediate stored XSS issues in your MISP deployment, enforce content security policy headers, and ensure session cookies are set with HttpOnly, Secure, and SameSite attributes.
   • Restrict and monitor site-admin accounts. Enforce MFA where supported and review the membership of the site-admin role.
   • Alert on any change to the Redis host settings for the core application, ZeroMQ, and SimpleBackgroundJobs, and on any re-enabling of download_attachments_on_load. These changes should be rare and expected; treat unexpected changes as incidents.
   • Network-isolate the Redis backend so that workers can reach only a trusted Redis endpoint. Egress filtering on the worker hosts prevents workers from connecting to an attacker-controlled Redis server even if the configured host is changed.
   • Apply Redis authentication and TLS, and bind the Redis listener to a management network that untrusted clients cannot reach.

2. Patch/upgrade steps.

   • Monitor the MISP security advisories, release notes, and GitHub repository for a fix addressing CVE-2026-106513. No patch exists per available data.
   • When a fixed release is published, test in staging and upgrade promptly, prioritizing instances with multiple site-admin users or broad intelligence-sharing exposure.
   • If you cannot upgrade immediately, restrict outbound connectivity from worker hosts and tightly control the site-admin role as compensating controls.

3. Long-term hardening.

   • Enforce least privilege: reduce the number of site-admin accounts and separate infrastructure-setting management from routine threat-intel operations.
   • Add integrity controls to job queues where feasible—authenticate job publishers and validate payload provenance rather than trusting raw Redis payloads.
   • Implement configuration-change auditing with immutable logging and alerting for the specific settings named in this CVE.
   • Conduct regular reviews of client-side rendering features such as download_attachments_on_load and their role in the XSS attack surface.
   • Segment the worker tier from the web tier and limit worker account privileges on the host.

References

• NVD — CVE-2026-106513: https://nvd.nist.gov/vuln/detail/CVE-2026-106513
• CWE-284: Improper Access Control — https://cwe.mitre.org/data/definitions/284.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• MISP Project — Security advisories and release notes: https://github.com/MISP/MISP
• FIRST.org EPSS — no score available for this CVE at time of writing: https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-106513 at the time of writing. The CVE is not listed in CISA KEV, no public proof-of-concept is available, and no Nuclei template has been published.