CVE-2026-112188: MISP Information Disclosure Vulnerability

CVE-2026-112188 Overview

CVE-2026-112188 is an information disclosure vulnerability in the Malware Information Sharing Platform (MISP) server settings lookup mechanism. Authenticated users can retrieve sensitive configuration data that should have been redacted by the application.

The flaw resides in how MISP resolves dotted setting names to configuration nodes. Supplying a branch name such as Security, MISP, or Plugin returns the entire sub-tree rather than a single leaf value. Because branch nodes do not carry a redaction flag, the redaction check is bypassed and sensitive secrets are returned to the caller.

Critical Impact
Any authenticated user with access to the server settings endpoints can retrieve the MISP security salt, Redis connection passwords, and plugin API keys, enabling further compromise of integrated systems.

Affected Products

MISP versions prior to 2.5.48
MISP server settings lookup endpoint
MISP server settings edit endpoint

Discovery Timeline

2026-10-19 - CVE-2026-112188 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-112188

Vulnerability Analysis

The vulnerability stems from how MISP resolves configuration setting names in app/Model/Server.php. The settings lookup function accepts a dotted name and walks the configuration tree to find a matching node. The function was designed to return individual leaf settings, each of which carries metadata including a redaction flag used to mask sensitive values.

When a caller supplies a branch name instead of a specific leaf, the function returns the entire sub-tree. Branch nodes do not carry a level key or a redaction flag, so the downstream redaction logic in the settings retrieval endpoint silently skips masking and returns the raw contents.

A second endpoint responsible for editing server settings exhibits the same behavior. When a branch name is resolved, the endpoint reads the entire configuration store and returns every setting to the caller, including values intended to remain server-side only.

This is a classic Information Exposure issue tracked under CWE-200. The impact is disclosure of secrets that protect session integrity, cache authentication, and third-party plugin integrations.

Root Cause

The settings lookup routine did not enforce that resolved nodes must be leaf settings. The redaction mechanism relied on a per-setting flag that only exists on leaves, so any branch resolution path bypassed redaction entirely.

Attack Vector

An authenticated user with permission to access the server settings endpoints submits a branch identifier such as Security, MISP, or Plugin. The server returns the entire sub-tree, including the security salt, Redis passwords, and plugin API keys. No elevated privileges beyond settings endpoint access are required.

php

            }
        }

-        if (isset($setting['level'])) {
-            $setting['name'] = $settingName;
-            if ($withOptions && isset($setting['optionsSource'])) {
-                $setting['options'] = $setting['optionsSource']();
-            }
+        // Only an individual setting can be addressed, never a whole branch:
+        // every caller treats the result as a leaf, and a branch carries no redaction flag.
+        if (!is_array($setting) || !isset($setting['level'])) {
+            return false;
+        }
+
+        $setting['name'] = $settingName;
+        if ($withOptions && isset($setting['optionsSource'])) {
+            $setting['options'] = $setting['optionsSource']();
        }

        return $setting;

Source: MISP commit 30b849102. The patch rejects any resolved node that is not an array containing a level key, forcing the lookup to address a single setting instead of a branch.

Detection Methods for CVE-2026-112188

Indicators of Compromise

Requests to MISP server settings endpoints where the setting name parameter matches a branch identifier such as Security, MISP, or Plugin rather than a dotted leaf setting.
Response payloads from settings endpoints that contain multiple configuration entries including fields referencing salt, redis_password, or plugin apikey values.
Unexpected authentication of external services (Redis, enrichment plugins) using credentials sourced from MISP after settings endpoint access.

Detection Strategies

Audit MISP application logs for calls to the serverSettingsEdit and server settings read endpoints and correlate against the parameter values submitted.
Alert on authenticated sessions that query the settings endpoints without a specific dotted leaf path.
Baseline normal administrative use of settings endpoints and flag deviations in frequency, user, or source IP.

Monitoring Recommendations

Forward MISP web server and application logs to a central analytics platform and retain settings endpoint access for forensic review.
Monitor Redis authentication failures and successful logins from unexpected clients that may indicate reuse of a disclosed password.
Rotate and monitor plugin API keys for anomalous use after any suspected exposure.

How to Mitigate CVE-2026-112188

Immediate Actions Required

Upgrade MISP to version 2.5.48 or later, which contains the patched settings lookup logic.
Rotate the MISP security salt, Redis connection passwords, and all plugin API keys that were present in the configuration prior to patching.
Review the list of users with access to server settings endpoints and remove unnecessary administrative privileges.
Audit historical logs for prior access to settings endpoints using branch identifiers.

Patch Information

The upstream fix is published in MISP commit 30b849102. The change modifies app/Model/Server.php so the setting resolver returns false whenever the resolved node is not an array containing a level key, preventing branch resolution and preserving the redaction behavior for every call site.

Workarounds

Restrict access to the MISP server settings endpoints at the reverse proxy or web application firewall until the patch is applied.
Limit the number of accounts with the role required to reach the settings endpoints and enforce strong authentication for those accounts.
Monitor and block requests whose setting name parameter does not contain a dot, which is a strong indicator of a branch lookup attempt.

bash

# Example nginx rule to block non-dotted setting names on the MISP settings endpoint
location ~ ^/servers/serverSettings(Edit)?/ {
    if ($arg_name !~ "\.") {
        return 403;
    }
    proxy_pass http://misp_backend;
}