MISP: Seven Vulnerabilities Disclosed Together, Including High Severity Flaws
Key findings • Seven MISP vulnerabilities disclosed on October 19, 2026, ranging from Medium to High severity. • High severity flaws include sensitive configuration data exposure and improper…
Key findings
- Seven MISP vulnerabilities disclosed on October 19, 2026, ranging from Medium to High severity.
- High severity flaws include sensitive configuration data exposure and improper access control for proposals.
- Medium severity issues involve reflected XSS, data integrity flaws during event deletion, and module setting handling.
- Vulnerabilities impact core MISP functionalities like data handling, configuration management, and synchronization.
- Prompt patching and updating MISP instances is crucial to mitigate these security risks.
On October 19, 2026, a batch of seven vulnerabilities was disclosed for MISP, a threat intelligence platform. These vulnerabilities, disclosed within a one-hour window, range in severity from Medium to High, impacting various aspects of the platform's security and data integrity. The disclosures highlight potential risks in handling module plugin settings, server configuration lookups, cross-site scripting, data integrity during event deletion, event synchronization, and proposal visibility logic.
Several vulnerabilities stem from how MISP handles sensitive data and configurations. CVE-2026-112192, a Medium severity vulnerability, arises from the server dropping redacted and cli_only flags when rebuilding module-supplied settings for API consumption. This could lead to sensitive information, such as API keys, being exposed. Similarly, CVE-2026-112188, a High severity flaw, allows authenticated users to retrieve sensitive configuration data that should have been redacted due to a flaw in the server settings lookup mechanism. This mechanism resolves dotted setting names to nodes in the configuration tree, and a branch name like "Security" or "MISP" could inadvertently expose data.
Cross-site scripting (XSS) and data integrity issues were also part of this disclosure batch. CVE-2026-112184, a Medium severity reflected XSS vulnerability, exists in the workflow module interface. Parameter names from the misp-modules service are rendered as raw HTML form labels without proper output encoding, potentially allowing an attacker to inject malicious scripts. Another Medium severity vulnerability, CVE-2026-112180, concerns data integrity during event deletion. When an event is deleted, associated records such as event report tags, event graph entries, and proposal correlations are not removed from the database, leading to orphaned entries.
Further issues were found in event synchronization and proposal visibility. CVE-2026-112179, a Medium severity vulnerability, involves a logic error in the event synchronization process. A filtering error during the preparation of event reports for remote push meant that all reports except the last one were not properly filtered for non-exportable tags. Lastly, CVE-2026-112178, a High severity access control flaw, affects the proposal (shadow attribute) visibility logic. The authorization check incorrectly allowed attributes or objects with user sharing groups without verifying distribution levels, while also denying the owning organization access to its own proposals.
The timely disclosure of these vulnerabilities underscores the importance of regular security audits and prompt patching for MISP instances. Users are advised to consult the official MISP security advisories for specific remediation steps and affected version information. Addressing these issues is crucial to maintaining the integrity and confidentiality of threat intelligence data managed within MISP.
The batch of vulnerabilities was disclosed on October 19, 2026. All identified vulnerabilities have been addressed in subsequent releases. Users are strongly encouraged to update to the latest version of MISP to mitigate these risks.
Key findings from this batch include:
- High severity flaws in sensitive data exposure and access control logic.
- Medium severity reflected XSS and data integrity issues during event deletion.
- Vulnerabilities related to module plugin settings and event synchronization.
- All seven CVEs were disclosed on the same day, indicating a coordinated disclosure event.
- The vulnerabilities impact core functionalities including configuration management, data handling, and access control.
- Prompt patching is essential to protect sensitive threat intelligence data.