Description
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.

As a result:

- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.

- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.

An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.

Affected: <2.5.48
Published: 2026-10-19
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Exposure of sensitive module credentials and unauthorized modification of CLI‑only settings via the API
Action: Apply Patch
AI Analysis

Impact

The vulnerability arises when MISP rebuilds module‑supplied settings for API consumption and unintentionally removes the redacted and cli_only flags defined in the module’s metadata. A setting marked as redacted, such as an API key, is nevertheless returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, allowing any authenticated user with server‑settings access to read highly sensitive credentials. Likewise, a setting intended to be editable only via the command line can still be altered through the API, bypassing the module author’s intended access restriction. This allows privileged users to both read confidential data and change configuration values that were meant to be protected.

Affected Systems

The issue affects MISP deployments using versions earlier than 2.5.48. Any module configuration that relies on the redacted or cli_only flags is potentially compromised in these releases.

Risk and Exploitability

MISP assigns a CVSS score of 5.3, indicating a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is through the servers/getSetting and servers/serverSettingsEdit API endpoints and requires an authenticated user with sufficient server‑settings privileges. Because the weakness touches both information exposure (CWE‑200) and missing authorization controls (CWE‑862), the risk is chiefly confined to users with elevated access rather than to the general public. While the probability of exploitation is moderate, the potential impact to confidentiality for privileged accounts warrants prompt attention.

Generated by OpenCVE AI on October 19, 2026 at 10:21 UTC.

Remediation

Vendor Solution

The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.

OpenCVE Recommended Actions

  • Apply the official MISP patch that preserves the redacted and cli_only flags for module settings (MISP 2.5.48 or later).
  • Immediately revoke and rotate any module API keys that were exposed by the vulnerable configuration and re‑store them as redacted settings.
  • Restrict access to the servers/getSetting and servers/serverSettingsEdit API endpoints to trusted administrators only, ensuring that only users who legitimately need to view or edit module settings can use these calls.

Generated by OpenCVE AI on October 19, 2026 at 10:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 09:45:00 +0000

Type Values Removed Values Added
Description MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata. As a result: - A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings. - A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction. An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access. Affected: <2.5.48
Title MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
First Time appeared Misp
Misp misp
Weaknesses CWE-200
CWE-862
CPEs cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Vendors & Products Misp
Misp misp
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-10-19T09:28:08.054Z

Reserved: 2026-10-19T09:28:06.573Z

Link: CVE-2026-112192

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-19T10:16:47.563

Modified: 2026-10-19T10:16:47.667

Link: CVE-2026-112192

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T10:30:13Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-862

    Missing Authorization