CVE-2026-112188
7.1HighPublished 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-200, CWE-285
Impact
Authenticated users can expose sensitive server secrets like the security salt, Redis passwords, and plugin API keys. They only need access to the server settings endpoints with valid low-privilege credentials.
Root cause
Requesting a configuration branch name instead of a leaf setting returns the entire configuration sub-tree, bypassing leaf-level redaction checks.
Affected systems
MISP < 2.5.48
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade MISP to version 2.5.48 or later. If patching immediately is not possible, restrict user access to server settings endpoints.
$ cd /var/www/MISP && git fetch && git checkout v2.5.48 && git submodule update --init --recursiveAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys. A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller. The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints. Affected versions: <2.5.48.