MISP leaks redacted module settings and lets users edit CLI-only ones
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-862.
Summary
MISP before 2.5.48 mishandles module plugin settings. When it rebuilds module settings for the API, it drops the redacted and cli_only flags that modules declare, so access restrictions are not enforced (CWE-862). An authenticated user with access to server settings can read sensitive module credentials and modify settings intended for CLI-only changes.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata. As a result: - A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings. - A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction. An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access. Affected: <2.5.48
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update MISP to version 2.5.48, which fixes this flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA MISP (MISP) Fixed in 2.5.48
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
MISP 2.5.48
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-76319 MISP server settings lookup exposes configuration secretsPriority LOW 31
- TI-2026-76314 Missing authorization in MISP proposal visibility exposes shadow attributesPriority LOW 31
- TI-2026-76315 Non-exportable tags leak to remote MISP instances during event syncPriority LOW 24
Timeline
- 2026-10-19 Threatist record created from CVE-2026-112192
- 2026-10-19 Alias added: GHSA-8p2f-rwxg-cq4h
- 2026-10-19 CISA SSVC decision points changed
- 2026-10-30 Affected versions changed · CNA
References
Patch 1
More MISP vulnerabilities
- TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
- TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
- TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
- TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
- TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
- TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
Sources
- CVE-2026-112192 · CVE Program
- CVE-2026-112192 · NVD
- FIRST EPSS
- GHSA-8p2f-rwxg-cq4h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences