Description
The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked. 

Any local unprivileged user on the system could read the log file or the FIFO to obtain these credentials. 

Additionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location.

Version affected: <2.5.47
Published: 2026-09-22
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure of Sensitive Credentials
Action: Apply Patch
AI Analysis

Impact

During installation, the MISP installer creates a log file and a FIFO to capture installer output. The log contains the generated admin password, database passwords, GPG passphrase, and supervisor password. The files were created with the system umask, resulting in world‑readable permissions, and the log was not removed before creation, allowing a pre‑existing symlink to redirect the write to an arbitrary location. As a result, any local unprivileged user could read the log or FIFO and obtain these credentials, or manipulate the write location to exfiltrate sensitive data.

Affected Systems

The vulnerability exists in the MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 on all versions earlier than 2.5.47. The affected products are the MISP package and its installer components, primarily the scripts that generate /var/log/misp_install.log and /var/log/misp_install.log.pipe.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.9, indicating a medium severity. Because the attack vector requires local, non‑privileged access and does not rely on network interfaces, the EPSS score is not reported, and it is not listed in CISA’s KEV catalog. A local user who can log into the system can exploit the world‑readable log or the FIFO to obtain hard‑coded credentials or can abuse a symlink attack if a malicious symlink is placed in /var/log prior to installation.

Generated by OpenCVE AI on September 22, 2026 at 15:37 UTC.

Remediation

Vendor Solution

The installer scripts now explicitly create the log file with 0600 permissions using install -m 0600 and the FIFO with mkfifo -m 0600, ensuring both are root-readable/writable only from the moment of creation. The log file is also removed (rm -f) before creation to prevent a pre-existing symlink in /var/log from being used to redirect the write to an attacker-controlled path. This matches the existing 0600 treatment applied to /root/misp_settings.txt by the save_settings() function.

OpenCVE Recommended Actions

  • Upgrade to the latest MISP release where the installer creates the log and FIFO with 0600 permissions and removes any existing log before creation
  • If upgrading immediately is not possible, secure the log and FIFO by changing their permissions to 0600 or restricting to the root group using chmod and chown
  • Audit the /var/log directory for pre‑existing symlinks that could be used for redirection and remove or rename them before running the installer
  • After installation, delete the /var/log/misp_install.log file and unlink the FIFO to eliminate residual credential exposure

Generated by OpenCVE AI on September 22, 2026 at 15:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Misp
Misp misp
Vendors & Products Misp
Misp misp

Tue, 22 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked.  Any local unprivileged user on the system could read the log file or the FIFO to obtain these credentials.  Additionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location. Version affected: <2.5.47
Title MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
Weaknesses CWE-22
CWE-732
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-22T15:32:43.415Z

Reserved: 2026-09-22T13:11:36.849Z

Link: CVE-2026-95667

cve-icon Vulnrichment

Updated: 2026-09-22T15:32:39.857Z

cve-icon NVD

Status : Deferred

Published: 2026-09-22T14:17:21.593

Modified: 2026-09-22T16:18:21.917

Link: CVE-2026-95667

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T15:45:17Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-732

    Incorrect Permission Assignment for Critical Resource