Description
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.

The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.

A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.

The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.

Affected versions: <2.5.48.
Published: 2026-10-19
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Configuration Disclosure
Action: Apply Patch
AI Analysis

Impact

The vulnerability occurs when the settings lookup function resolves a branch name instead of a leaf setting. Because branch nodes lack a redaction flag, the function returns the entire sub‑tree, exposing secrets such as the security salt, Redis passwords, and plugin API keys to any authenticated user who can access the server settings endpoints.

Affected Systems

MISP, Version < 2.5.48

Risk and Exploitability

This is a high severity flaw with a CVSS score of 7.1. An attacker only needs a valid authenticated session on the MISP server to exploit the issue. The exploitation does not require network access beyond normal API usage, but the information disclosed may enable further compromise of related services. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 19, 2026 at 11:27 UTC.

Remediation

Vendor Solution

The settings lookup function now validates that the resolved node is a leaf setting (has a 'level' property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values.

OpenCVE Recommended Actions

  • Upgrade MISP to version 2.5.48 or later to enforce leaf‑setting validation in the lookup function, mitigating information exposure (CWE‑200).
  • Restrict access to the server settings endpoints to privileged users only, addressing improper authorization (CWE‑285).
  • Review and harden any remaining configuration settings that may contain sensitive data, ensuring redaction flags are correctly applied to protect against information disclosure (CWE‑200).

Generated by OpenCVE AI on October 19, 2026 at 11:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 09:45:00 +0000

Type Values Removed Values Added
Description MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys. A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller. The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints. Affected versions: <2.5.48.
Title MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
First Time appeared Misp
Misp misp
Weaknesses CWE-200
CWE-285
CPEs cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Vendors & Products Misp
Misp misp
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-10-28T20:05:58.430Z

Reserved: 2026-10-19T09:22:31.139Z

Link: CVE-2026-112188

cve-icon Vulnrichment

Updated: 2026-10-28T17:47:42.423Z

cve-icon NVD

Status : Deferred

Published: 2026-10-19T10:16:47.413

Modified: 2026-10-28T20:17:19.143

Link: CVE-2026-112188

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T17:45:13Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-285

    Improper Authorization