CVE-2026-56447 Overview
CVE-2026-56447 affects MISP (Malware Information Sharing Platform), an open-source threat intelligence platform maintained by the MISP Project. The vulnerability allows an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP parses the referenced INI file and forwards its options to rdkafka. An attacker can abuse rdkafka options such as plugin.library.paths to load an external shared library, achieving arbitrary code execution with the privileges of the MISP web process. The flaw is classified under [CWE-829: Inclusion of Functionality from Untrusted Control Sphere].
Critical Impact
A compromised or malicious site administrator can chain a writable upload location with the Kafka configuration setting to obtain remote code execution on the MISP host.
Affected Products
- MISP Project MISP (versions prior to the commit 9600d486ccfc98388e13897fd954350cebac5fb0)
- Deployments exposing the site administrator role to network-reachable users
- MISP instances with writable upload or image directories accessible to administrators
Discovery Timeline
- 2026-06-22 - CVE-2026-56447 published to the National Vulnerability Database
- 2026-06-23 - Last updated in NVD
Technical Details for CVE-2026-56447
Vulnerability Analysis
The vulnerability stems from MISP accepting an unvalidated filesystem path for the Kafka_rdkafka_config configuration setting. MISP loads the supplied INI file and passes the parsed options directly to the rdkafka library. The rdkafka library supports a plugin.library.paths option that loads arbitrary shared libraries from disk. An attacker controlling both the INI file path and its contents can therefore force MISP to dlopen an attacker-supplied library, executing code inside the MISP PHP process.
Exploitation requires the attacker to first place a crafted INI file on the MISP host. Several MISP-writable locations satisfy this requirement, including event attachment uploads and administrative image upload targets. Because these directories are writable by the MISP process itself, no shell access is needed to stage the payload.
Root Cause
MISP did not constrain the value of Kafka_rdkafka_config to a vetted set of configuration directories. The setting accepted any absolute or relative path, including locations beneath the webroot or inside user-controllable upload directories. Once the INI file was loaded, no allow-list filtered which rdkafka options could be applied, leaving dangerous options such as plugin.library.paths reachable.
Attack Vector
The attack chain requires site-administrator privileges, then proceeds as follows. The attacker uploads a malicious INI file and a companion shared library through a MISP feature that writes to disk, such as event attachments or branding images. The attacker then sets Kafka_rdkafka_config to the uploaded INI path. The next Kafka-triggering action causes MISP to parse the INI file, invoke rdkafka, and load the attacker's shared library, executing code as the web user.
return true;
}
+ public function testLogPath($value)
+ {
+ // Controls where the ndjson error log is written (JsonLogTool). Those log
+ // lines can contain attacker-influenced content, so an unconstrained path
+ // is an RCE primitive (e.g. writing a *.php file under the webroot). We are
+ // therefore strict about BOTH the target directory and the file name.
+
+ // Empty is allowed: the logger falls back to its built-in default under
+ // APP/tmp/logs. On the save path the value already arrives trimmed.
+ if ($value === null || !is_string($value) || trim($value) === '') {
+ return true;
+ }
+ $value = trim($value);
+
+ // No NUL bytes, line breaks or stream wrappers (phar://, php://, ...).
+ if (strpos($value, "\0") !== false || preg_match('/[\r\n]/', $value) || strpos($value, '://') !== false) {
+ return 'Invalid characters in the log path.';
+ }
+
+ // Must be an absolute path.
+ if ($value[0] !== '/') {
+ return 'The log path must be an absolute path.';
+ }
+
+ // Resolve the parent directory so that symlinks and '..' traversal are
+ // collapsed before the allow-list check. The file need not exist yet, but
+ // its directory must (JsonLogTool does not create directories).
Source: MISP commit 9600d486. The patch validates path inputs for stream wrappers, NUL bytes, line breaks, and absolute-path requirements, and enforces an allow-list of directories outside the webroot and upload targets.
Detection Methods for CVE-2026-56447
Indicators of Compromise
- Modifications to the Kafka_rdkafka_config setting visible in the MISP audit log, especially values pointing under app/webroot/, app/tmp/, or app/files/.
- INI files appearing in MISP upload directories that contain plugin.library.paths, plugin.library, or other rdkafka plugin keys.
- Unexpected shared object (.so) files staged alongside event attachments or organization logos.
- New child processes of the MISP web user spawning shells, network listeners, or outbound connections after a Kafka-related action.
Detection Strategies
- Hunt the MISP audit_logs table for Server.Kafka_rdkafka_config change events and correlate with the originating administrator account.
- Inspect on-disk content of MISP upload paths for .ini and .so files using file integrity monitoring.
- Review the PHP-FPM or Apache process tree for child processes that load unexpected shared libraries via dlopen.
Monitoring Recommendations
- Forward MISP application logs and webserver logs to a centralized SIEM and alert on configuration setting changes by administrative accounts.
- Monitor outbound network connections initiated by the MISP web process for command-and-control patterns.
- Track creation of executable files within any directory writable by the MISP service account.
How to Mitigate CVE-2026-56447
Immediate Actions Required
- Upgrade MISP to a release containing commit 9600d486ccfc98388e13897fd954350cebac5fb0 or later.
- Audit the current value of Kafka_rdkafka_config on every MISP instance and reset it if it points outside an approved configuration directory.
- Review site-administrator accounts, rotate credentials, and disable accounts that are no longer required.
- Scan MISP upload directories for unexpected .ini and .so artifacts and remove them.
Patch Information
The MISP project addressed the vulnerability by restricting Kafka_rdkafka_config to absolute .ini files located only in approved configuration directories outside the webroot and MISP upload targets. The fix is published in the MISP security commit 9600d486. Administrators should pull the latest stable MISP release and verify the commit is present in their deployment.
Workarounds
- Until patching is possible, clear the Kafka_rdkafka_config value and disable Kafka integration in the MISP server settings.
- Restrict filesystem permissions so the MISP web process cannot read from upload directories when loading configuration files.
- Limit site-administrator privileges to a minimal set of trusted operators and enforce strong authentication.
# Verify the patched commit is present in your MISP checkout
cd /var/www/MISP
git log --oneline | grep 9600d486
# Inspect the current Kafka configuration path
sudo -u www-data /var/www/MISP/app/Console/cake Admin getSetting Plugin.Kafka_rdkafka_config
# Reset the setting to an empty value if it points outside approved directories
sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting Plugin.Kafka_rdkafka_config ""
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
