CVE-2026-112192: MISP Information Disclosure Vulnerability

CVE-2026-112192 Overview

CVE-2026-112192 is an information disclosure and access control weakness in Malware Information Sharing Platform (MISP) versions before 2.5.48. The server strips the redacted and cli_only flags that module authors declare in their configuration metadata when it rebuilds module-supplied settings for API consumption. As a result, authenticated users with access to server settings can read sensitive module credentials such as API keys, and modify settings that module authors intended to restrict to the command-line interface. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Any authenticated MISP user with permission to view server settings can retrieve plaintext module credentials and alter cli_only configuration via the web API, bypassing the module author's intended access controls.

Affected Products

MISP versions prior to 2.5.48
MISP server settings endpoints servers/getSetting and servers/serverSettingsEdit
MISP module plugin configuration subsystem

Discovery Timeline

2026-10-19 - CVE-2026-112192 published to the National Vulnerability Database
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-112192

Vulnerability Analysis

MISP modules declare their own settings metadata, including guard flags such as redacted (hide the value in API responses) and cli_only (settings editable only through the CLI). When the MISP server composed the aggregated serverSettings['Plugin'] structure for the API, it copied the module's declared description and value fields but discarded the module-level redacted and cli_only flags. The resulting setting object exposed to the API therefore carried none of the module author's intended guardrails.

Two concrete consequences follow. First, calls to servers/getSetting and servers/serverSettingsEdit return the raw value of settings a module marked as redacted, including API keys and other secrets. Second, settings a module marked cli_only become writable through the web API because the server no longer sees the flag that would route edits through the CLI-only path. The underlying weakness is a missing propagation of security-relevant metadata between the module definition and the server's settings model.

Root Cause

The root cause is in app/Model/Server.php, where the loop that merges a module's getConfig() output into $serverSettings['Plugin'] copies display fields but omits the module's own guard flags. Without those flags, downstream redaction logic and CLI-only enforcement never fire.

Attack Vector

Exploitation requires an authenticated session with privileges to read or edit server settings. An attacker queries servers/getSetting to harvest module-declared secrets in plaintext, or issues a servers/serverSettingsEdit request to overwrite settings that should only have been reachable from the CLI. No user interaction and no additional complexity are required beyond holding a valid settings-management role.

php

                            $setting['description'] = isset($result['description']) ? $result['description'] : __('Set this required module specific setting.');
                            $setting['value'] = isset($result['value']) ? $result['value'] : '';
                        }
+                        // The module's own guard flags are part of its setting definition.
+                        foreach (['redacted', 'cli_only'] as $flag) {
+                            if (!empty($result[$flag])) {
+                                $setting[$flag] = true;
+                            }
+                        }
                        $serverSettings['Plugin'][$moduleType . '_' . $module . '_' .  $result['name']] = $setting;
                    }
                }

Source: MISP commit 6c02f0f5c — the patch restores the redacted and cli_only flags during setting assembly.

Detection Methods for CVE-2026-112192

Indicators of Compromise

Unexpected GET requests to servers/getSetting targeting Plugin.* module setting keys, particularly those that include substrings such as apikey, token, secret, or password.
POST requests to servers/serverSettingsEdit modifying module plugin settings outside of normal change windows or from accounts that do not typically administer modules.
Audit log entries showing module setting reads or edits by low-tier administrator accounts rather than CLI operators.

Detection Strategies

Review MISP application and web server logs for authenticated access to the two affected endpoints and correlate against known administrator identities.
Alert on any API retrieval of settings whose module definitions declare redacted: true, since those values should never leave the server unmasked.
Baseline normal CLI-only setting changes and flag any web-API-sourced edits to the same configuration keys.

Monitoring Recommendations

Forward MISP audit logs and reverse proxy access logs to a centralized logging platform for retention and correlation.
Enable alerting on repeated reads of plugin settings by a single session, which may indicate credential enumeration.
Monitor administrative user account creation and role assignments granting access to server settings.

How to Mitigate CVE-2026-112192

Immediate Actions Required

Upgrade MISP to version 2.5.48 or later, which restores propagation of the redacted and cli_only flags.
Rotate every API key, token, and secret stored in module plugin settings, treating prior values as potentially exposed.
Audit the list of accounts holding server settings privileges and remove any that do not require them.

Patch Information

The fix is published in MISP commit 6c02f0f5c and included in MISP release 2.5.48. The patch updates app/Model/Server.php to carry the module-declared redacted and cli_only flags through to the server settings structure consumed by servers/getSetting and servers/serverSettingsEdit.

Workarounds

Restrict access to server settings endpoints at the reverse proxy or web application firewall until the upgrade is applied.
Reduce the number of accounts with the server settings permission to a small, audited administrator group.
Store module credentials outside of MISP module settings where feasible, for example by injecting them through environment variables managed on the host.

bash

# Verify the installed MISP version meets or exceeds the fixed release
cd /var/www/MISP
git fetch --tags
git checkout v2.5.48
sudo -u www-data php app/Console/cake Admin runUpdates