MISP’s CurlClient component contains an improper TLS certificate validation flaw where the peer verification flag defaults to null. When this value is passed to cURL, peer verification is effectively disabled unless the calling code explicitly enables it. As a result, HTTPS requests made through affected CurlClient instances can accept certificates issued by untrusted authorities, allowing an attacker controlling the network path to impersonate the remote endpoint and relay altered data to the MISP system. The flaw enables an attacker to eavesdrop on authentication material, exchange threat intelligence, and modify responses that MISP receives from external services, depending on the specific functionality using CurlClient.

The vulnerability affects all installations of the MISP application, specifically the CurlClient class in the main MISP package. Users of any MISP version lacking the default peer verification patch are susceptible. The affected product is the open‑source MISP platform; version details are not explicitly listed but any release before the commit that enables TLS peer verification by default is affected.

The flaw carries a CVSS score of 7.6, indicating high severity. EPSS score is not available, but the lack of explicit peer verification makes the vulnerability straightforward to exploit for an attacker with network interception capabilities. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is through network traffic interception between the MISP instance and a remote HTTPS service; an attacker can perform a man‑in‑the‑middle attack to intercept or tamper with data.