CVE-2026-86408: MISP Information Disclosure Vulnerability

CVE-2026-86408 Overview

CVE-2026-86408 is an authorization bypass vulnerability in MISP (Malware Information Sharing Platform) affecting versions ≤2.5.45. The flaw resides in CryptographicKeysController::view(), which queries cryptographic keys directly by ID without verifying access to the associated parent event. Any authenticated user can retrieve signing keys tied to protected events they have no permission to view. Exposed fields include type, key_data, and fingerprint, enabling attackers to obtain cryptographic material used to sign threat intelligence within restricted sharing groups.

Critical Impact

Authenticated users can retrieve signing keys for protected events, undermining the integrity and confidentiality of MISP threat intelligence sharing.

Affected Products

• MISP versions ≤2.5.45
• misp-project/misp package deployments
• Federated MISP instances sharing protected events

Discovery Timeline

• 2026-09-07 - CVE-2026-86408 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86408

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference [CWE-639] in the MISP web controller responsible for rendering cryptographic key details. The view($id) action in app/Controller/CryptographicKeysController.php performed a direct lookup on the CryptographicKey model using the user-supplied key ID. It returned sensitive fields but never resolved or authorized the parent event that owns the key.

MISP uses cryptographic keys to sign event data for integrity verification across federated instances. Keys associated with protected events must be visible only to users who can view the parent event. The missing authorization check breaks that model and turns a per-event ACL boundary into a flat, authenticated-only boundary.

Root Cause

The original query selected only id, type, key_data, and fingerprint without retrieving parent_id or parent_type. Without those foreign keys, the controller had no basis to invoke fetchSimpleEvent() or any other ACL routine. The handler assumed the calling context had already validated access, but the route was directly reachable by any authenticated user.

Attack Vector

An authenticated MISP user enumerates or guesses cryptographic key IDs and issues GET requests to the cryptographicKeys/view/{id} endpoint. The server returns the signing key material for events the user cannot otherwise access. The attacker can then forge signed events or decrypt intercepted content that relies on the exposed key.

// Patch from upstream commit 2edde619b
public function view($id)
{
    $user = $this->Auth->user();
    $key = $this->CryptographicKey->find('first', [
        'recursive' => -1,
        'fields' => ['id', 'type', 'key_data', 'fingerprint', 'parent_id', 'parent_type'],
        'conditions' => ['CryptographicKey.id' => $id]
    ]);
    if (empty($key)) {
        throw new NotFoundException(__('Invalid key.'));
    }
    // Authorise through the parent event.
    $parent_type = $key['CryptographicKey']['parent_type'];
    if ($parent_type !== 'Event') {
        if (empty($user['Role']['perm_site_admin'])) {
            throw new NotFoundException(__('Invalid key.'));
        }
    } else {
        $event = $this->CryptographicKey->Event->fetchSimpleEvent(
            $user,
            $key['CryptographicKey']['parent_id']
        );
        if (empty($event)) {
            throw new NotFoundException(__('Invalid key.'));
        }
    }
}

Source: MISP GitHub Commit 2edde619b

Detection Methods for CVE-2026-86408

Indicators of Compromise

• HTTP GET requests to /cryptographicKeys/view/{id} from user accounts that do not own the corresponding event
• Sequential or enumerated key ID access patterns from a single authenticated session
• Access to key IDs whose parent event is not present in the requesting user's audit trail

Detection Strategies

• Correlate MISP audit log entries for CryptographicKeys controller access against the event_id visibility of the requesting user
• Baseline normal access to cryptographicKeys/view and alert on volume anomalies from non-administrative accounts
• Inspect web server logs for enumeration behavior against the cryptographic key endpoint

Monitoring Recommendations

• Forward MISP application and web server logs to a centralized analytics platform for correlation
• Enable MISP's built-in audit logging (Security.log_auth) and retain records for post-incident review
• Alert on any invocation of cryptographicKeys/view by non-administrator accounts pending upgrade

How to Mitigate CVE-2026-86408

Immediate Actions Required

• Upgrade MISP to a version above 2.5.45 that includes commit 2edde619b
• Rotate any signing keys attached to protected events if unauthorized access is suspected
• Review user accounts and remove inactive or unnecessary authenticated users

Patch Information

The fix is applied in upstream commit 2edde619b to app/Controller/CryptographicKeysController.php. It expands the model query to include parent_id and parent_type, then calls fetchSimpleEvent($user, parent_id) to enforce the parent event ACL. Keys with a non-Event parent are restricted to site administrators. See the MISP GitHub Commit Details for the complete diff.

Workarounds

• Restrict access to the /cryptographicKeys/view route at the reverse proxy layer to administrative users until patched
• Temporarily disable cryptographic key rendering in the UI by removing the "Inspect key" link for non-admin roles
• Limit MISP account creation and audit existing user roles to reduce the pool of authenticated actors

# Example nginx restriction for the vulnerable endpoint
location ~* ^/cryptographicKeys/view/ {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://misp_backend;
}