CVE-2026-112180 Overview
CVE-2026-112180 is a data integrity vulnerability in Malware Information Sharing Platform (MISP) affecting versions prior to 2.5.48. The flaw resides in the event deletion logic, where several associated records are not purged from the database when a user deletes an event. Affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results. These orphaned records retain sensitive threat intelligence data that should have been removed with the parent event. The weakness is classified under [CWE-459: Incomplete Cleanup].
Critical Impact
Orphaned records containing correlation mappings, scan results, and report metadata persist after event deletion, creating unintended data retention and potential information exposure through other application queries.
Affected Products
- MISP versions prior to 2.5.48
- MISP event deletion workflow (app/Model/Event.php)
- Database tables: event_reports, event_graph, shadow_attribute_correlations
Discovery Timeline
- 2026-10-19 - CVE-2026-112180 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-112180
Vulnerability Analysis
MISP is an open-source threat intelligence platform used to share, store, and correlate indicators of compromise (IOCs). When an authenticated user with sufficient privileges deletes an event, the deletion routine fails to cascade across all tables that reference the parent event. The result is residual data that persists in the database beyond the intended deletion lifecycle.
The orphaned records can include sensitive threat intelligence artifacts such as correlation mappings between proposals, fuzzy ssdeep hash chunks used for similarity matching, and attachment scan results. These records may remain reachable through other data-access paths that do not validate the existence of the parent event, enabling unintended disclosure.
Over time, the accumulation of orphaned rows also contributes to storage bloat and degrades the referential integrity of the MISP database.
Root Cause
The root cause is incomplete cleanup logic in the event deletion routine within app/Model/Event.php. The deletion flow only enumerated a subset of child tables for removal, omitting event_graph, shadow_attribute_correlations, and other related tables that store foreign-key references to the deleted event_id.
Attack Vector
Exploitation requires an authenticated user with event deletion privileges. The attacker deletes an event that has associated reports, graphs, correlations, ssdeep chunks, or attachment scan results. The parent event record is removed, but linked rows remain in the database and can later be surfaced through administrative queries or other application interfaces that do not validate parent-event existence.
'table' => 'event_reports',
'foreign_key' => 'event_id',
'value' => $id
+ ),
+ array(
+ 'table' => 'event_graph',
+ 'foreign_key' => 'event_id',
+ 'value' => $id
+ ),
+ array(
+ 'table' => 'shadow_attribute_correlations',
+ 'foreign_key' => 'event_id',
+ 'value' => $id
+ ),
+ array(
+ 'table' => 'shadow_attribute_correlations',
+ 'foreign_key' => '1_event_id',
+ 'value' => $id
)
);
if ($thread_id) {
Source: GitHub MISP Commit 5f78634af. The patch extends the deletion array to include event_graph and shadow_attribute_correlations tables, ensuring child rows are removed with the parent event.
Detection Methods for CVE-2026-112180
Indicators of Compromise
- Rows in event_reports, event_graph, or shadow_attribute_correlations whose event_id no longer corresponds to any row in the events table.
- Growth of correlation or ssdeep chunk tables that outpaces active event counts over time.
- Attachment scan result records referencing deleted event identifiers.
Detection Strategies
- Run database integrity queries that LEFT JOIN child tables against the events table to enumerate orphaned rows.
- Audit MISP application logs for event deletion operations and compare against row counts in referenced child tables.
- Monitor administrative queries and API endpoints that return event-related metadata without validating parent existence.
Monitoring Recommendations
- Track the MISP version in use and alert when instances run versions earlier than 2.5.48.
- Schedule periodic referential integrity checks across all event-linked tables.
- Log and review activity performed by accounts with event deletion privileges.
How to Mitigate CVE-2026-112180
Immediate Actions Required
- Upgrade MISP to version 2.5.48 or later to apply the complete deletion cascade fix.
- Review and reduce the number of accounts holding event deletion privileges to the minimum required.
- Execute cleanup queries to purge orphaned rows left by prior deletions in event_graph, shadow_attribute_correlations, and related tables.
Patch Information
The vendor fix is published in the MISP repository at commit GitHub MISP Commit 5f78634af. The commit extends the deleteEvent cleanup array in app/Model/Event.php so that rows in event_graph and shadow_attribute_correlations (keyed by both event_id and 1_event_id) are removed alongside the parent event. Fixed version: 2.5.48.
Workarounds
- Restrict event deletion privileges to a small set of trusted administrators until the patch is applied.
- Run scheduled database maintenance jobs that delete rows in child tables whose event_id has no matching parent in the events table.
- Limit exposure of administrative interfaces and API endpoints that may surface orphaned event-related data.
# Example cleanup query to identify orphaned shadow_attribute_correlations rows
mysql -u misp -p misp -e "SELECT sac.* FROM shadow_attribute_correlations sac \
LEFT JOIN events e ON sac.event_id = e.id \
WHERE e.id IS NULL LIMIT 100;"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
