MISP: Critical Auth Bypass and High Auth Inconsistencies Among Five Disclosed Vulnerabilities
Five vulnerabilities, including a Critical authentication bypass and a High authorization inconsistency, were disclosed for MISP on September 14, 2026.
Key findings
- Five vulnerabilities disclosed for MISP on September 14, 2026, ranging from Critical to Medium severity.
- Authentication bypass in LdapAuth and LinOTPAuth plugins (CVE-2026-90961) poses a Critical risk.
- Inconsistent access control in the interactive CLI shell (CVE-2026-90895) leads to High severity authorization issues.
- Insecure handling of uploaded SVG files (CVE-2026-90957) and CSRF in user settings (CVE-2026-90893) are among the disclosed Medium severity flaws.
- Patches are available; users are urged to update MISP instances promptly.
On September 14, 2026, a batch of five vulnerabilities was disclosed for MISP, the open-source threat intelligence platform. The vulnerabilities, disclosed within a four-hour window, span critical, high, and medium severity ratings and affect various components of the MISP application, including authentication plugins, file handling, the command-line interface, and the web application's security controls. These disclosures highlight potential weaknesses in how MISP handles user authentication, file uploads, command-line operations, and cross-site request forgery protection.
Two of the disclosed vulnerabilities, CVE-2026-90961 and CVE-2026-90895, present the most significant risks. CVE-2026-90961, rated Critical, affects the LdapAuth and LinOTPAuth authentication plugins. It allows for an authentication bypass due to a failure to replicate input validation guards present in CakePHP's FormAuthenticate class, potentially exposing sensitive user credentials. CVE-2026-90895, a High severity vulnerability, stems from inconsistencies in the access control implementation within MISP's interactive CLI shell, which operates independently from the web application. This could lead to authorization bypasses in security-sensitive areas such as feed listings.
Further vulnerabilities include CVE-2026-90957 (Medium), which concerns the insecure handling of uploaded SVG images. MISP serves these files inline without adequate browser sandbox restrictions, posing a risk as SVGs are XML documents that can contain executable scripts. CVE-2026-90955 (Medium) impacts the interactive CLI shell's audit logging, where the identity of the impersonated user might not be reliably preserved across logs due to legacy behavior. Lastly, CVE-2026-90893 (Medium) is a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController, where specific actions related to theme and home page settings were exempted from CSRF validation, leaving them open to malicious manipulation.
The disclosures indicate that patches are available for these issues. Users are strongly advised to update their MISP instances to the latest versions to mitigate these security risks. The specific versions affected and patched are detailed in the respective security advisories.
This coordinated disclosure of multiple vulnerabilities across different functional areas underscores the importance of maintaining up-to-date security practices for MISP deployments. Users should review the details of each CVE to understand the specific risks to their instances and ensure timely application of patches. The variety of issues, from authentication bypass to CSRF, highlights the need for a comprehensive security approach.