An authenticated MISP site administrator can set the Kafka_rdkafka_config to an arbitrary filesystem path. MISP then parses the referenced INI file and passes its options to the rdkafka library. A crafted configuration file can exploit rdkafka settings such as plugin.library.paths to load an external library, enabling arbitrary code execution with the privileges of the running MISP process. An attacker can place the malicious configuration file in any MISP-writable location like an uploaded file or administrative image.

The affected product is MISP (misp:misp). No specific version range is listed, but the vulnerability applies to installations that allow an authenticated administrator to modify the Kafka_rdkafka_config setting. All affected instances are those before the fix that removes the restriction on the setting path.

CVSS score 9.3 indicates critical severity. EPSS is not available, so the exact exploitation probability is uncertain but the flaw's nature suggests a high potential for use. The vulnerability is not listed in CISA KEV. Exploitation requires authenticated administrative access and the ability to place a file in a writable MISP location; once executed, the attacker could run arbitrary code at the MISP process level. The attack vector is via the administrative configuration interface, making it a targeted internal threat.