CVE-2026-86452: MISP Platform DOS Vulnerability

CVE-2026-86452 Overview

CVE-2026-86452 is an uncontrolled resource consumption vulnerability [CWE-400] in MISP, the open-source threat intelligence sharing platform maintained by the MISP Project. Affected versions permit unauthenticated request paths to trigger persistent storage operations without input bounds, format validation, or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value and stored it more than once per request (once as an audit log entry, once as a queued password-reset job) with no throttling. Anonymous attackers can inflate database storage and job queues by flooding these endpoints. The flaw affects MISP versions ≤2.5.45.

Critical Impact

Unauthenticated attackers can exhaust MISP database and queue resources by repeatedly submitting oversized email values to password-reset, registration, and REST authentication endpoints.

Affected Products

• MISP versions ≤2.5.45
• The users/forgot password-reset endpoint
• The API-access request endpoint

Discovery Timeline

• 2026-09-07 - CVE-2026-86452 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86452

Vulnerability Analysis

MISP exposes several pre-authentication endpoints that trigger persistent database work. The users/forgot endpoint accepted an email value from anonymous callers without enforcing a length ceiling or validating the RFC-defined address format. That value was then written to the audit log and queued as a password-reset job, meaning a single HTTP request produced at least two persistent rows in backing storage. No per-source request budget existed, so the endpoint could be invoked repeatedly at machine speed.

Related pre-authentication paths, including user registration and failed REST authentication attempts, exhibited the same anonymous write amplification pattern. An attacker with only network reachability to the MISP web interface can consume database rows, job-queue capacity, and disk space until the instance degrades or fails.

Root Cause

The root cause is missing input validation and missing rate limiting on unauthenticated endpoints that perform persistent work. The commit note explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle. Attacker-controlled input reached the audit log and job queue before any format check, length bound, or per-source counter evaluated the request.

Attack Vector

The attack requires only network access to the MISP HTTP interface. An attacker sends repeated POST requests to users/forgot (or a comparable pre-auth endpoint) supplying large or malformed email strings. Each request is persisted at least twice. Sustained flooding inflates the database, saturates the job worker, and produces a denial-of-service condition against threat intelligence operations.

// Patch excerpt: app/Console/Command/AdminShell.php
        $email = $this->args[0];
        $ip = empty($this->args[1]) ? null : $this->args[1];
        $jobId = empty($this->args[2]) ? null : $this->args[2];
-        $this->User->forgot($email, $ip, $jobId);
+        // User::forgot() takes two arguments; the job id is this shell's to
+        // resolve, exactly as every other job* method in this file does.
+        $this->User->forgot($email, $ip);
+        // Uniform whatever forgot() returned. Recording the hit or miss here
+        // would put an account-enumeration answer in the jobs table, which is
+        // the same reason forgotRouter() queues before it looks anybody up.
+        $this->Job->saveStatus($jobId, true, __('Password reset request processed.'));
// Source: MISP commit d75d899be

Detection Methods for CVE-2026-86452

Indicators of Compromise

• Repeated POST requests to users/forgot or the API-access request endpoint from a single source IP or narrow IP range.
• Rapid growth in the MISP audit log and background job tables without a corresponding rise in legitimate user activity.
• Unusually long email values (approaching or exceeding 1024 bytes) recorded in application logs.
• Job queue backlog on password-reset workers with matching email addresses on many queued entries.

Detection Strategies

• Monitor web server access logs for high-rate POST traffic to /users/forgot, /users/register, and REST authentication paths.
• Alert on the ratio of pre-authentication endpoint requests to successful password resets exceeding normal baselines.
• Track database row growth rates on audit log and jobs tables to catch inflation attacks early.

Monitoring Recommendations

• Enable web application firewall logging in front of the MISP instance and forward events to a centralized SIEM for correlation.
• Set alert thresholds for HTTP 429 responses after the patch is applied to identify active abuse attempts.
• Review MISP application logs daily for malformed email inputs and repeated failed pre-authentication attempts.

How to Mitigate CVE-2026-86452

Immediate Actions Required

• Upgrade MISP to a version above 2.5.45 that includes commit d75d899be.
• Enable the new Security.pre_auth_flood_filter_enable setting and tune Security.pre_auth_flood_filter_threshold for the deployment.
• Place the MISP web interface behind a reverse proxy or WAF that enforces per-source rate limits on /users/forgot and related endpoints.
• Audit database growth on audit log and job queue tables and purge attacker-generated entries.

Patch Information

The fix is delivered in MISP commit d75d899be and enforces a 1024-byte maximum email length, email-format validation before persistent work, a per-source pre-authentication request budget with HTTP 429 responses on excess, a 15-minute cooldown for API-access request emails, and POST-only handling with CSRF protection on the API-access request endpoint. See the MISP security commit for full details.

Workarounds

• Restrict network access to the MISP web interface to trusted networks or VPN clients until the patch is applied.
• Deploy reverse-proxy rate limiting (for example nginx limit_req_zone) targeting /users/forgot, /users/register, and REST authentication paths.
• Temporarily disable password self-service by setting Security.allow_password_forgotten to false if the endpoint is not required.

# nginx reverse-proxy rate limit example for MISP pre-auth endpoints
limit_req_zone $binary_remote_addr zone=misp_preauth:10m rate=5r/m;

server {
    location ~ ^/(users/forgot|users/register|servers/restApi) {
        limit_req zone=misp_preauth burst=10 nodelay;
        limit_req_status 429;
        proxy_pass http://misp_backend;
    }
}