CVE-2026-90895: MISP Interactive CLI Auth Bypass Vulnerability

CVE-2026-90895 Overview

CVE-2026-90895 affects the Malware Information Sharing Platform (MISP) interactive command-line interface (CLI) shell. The CLI implements access control independently from the web application, producing authorization inconsistencies across feeds, servers, and sharing groups. Local users with CLI access can retrieve records and credential material they are not authorized to view through the web UI. Affected versions are MISP ≤2.5.45. The weakness is categorized as improper neutralization of special elements [CWE-150] with additional broken access control characteristics.

Critical Impact
Local users with MISP CLI access can enumerate feeds and servers outside their organization and retrieve embedded HTTP authorization headers and synchronization authkey values that should remain hidden.

Affected Products

MISP (Malware Information Sharing Platform) versions ≤2.5.45
MISP interactive CLI shell components under app/Console/Command/CLIShell/
Deployments exposing CLI access to non-host-organisation operators

Discovery Timeline

2026-09-14 - CVE-2026-90895 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90895

Vulnerability Analysis

The MISP CLI shell duplicated access-control logic instead of delegating to the same model accessors used by the web controllers. This duplication produced multiple divergences that expose data across trust boundaries.

Feed listings did not enforce the lookup_visible restriction applied to non-host-organisation users. Feed detail access skipped the host-organisation and site-admin checks performed by FeedsController::view(). The Feed.headers field, which can carry HTTP Authorization credentials for upstream feeds, was returned in CLI output rather than masked. Server synchronization authkey values were not explicitly hidden in server detail output. Sharing-group detail access failed to consistently call SharingGroup::checkIfAuthorised(). The use command established record context without first verifying the caller had permission to view that record.

The patch additionally hardens pagination and neutralizes terminal control sequences embedded in database-backed values, mitigating terminal-injection risks tied to [CWE-150].

Root Cause

The root cause is authorization logic implemented directly inside CLI command handlers rather than routed through the shared model-layer accessors that back FeedsController, the server controllers, and SharingGroup::checkIfAuthorised(). Sensitive fields such as Feed.headers and server authkey were not placed on an explicit hide-list for CLI serialization.

Attack Vector

Exploitation requires local access with low privileges to the MISP CLI shell. An authenticated CLI user issues feed, server, or sharing-group listing and detail commands, then uses the use command to pivot into records outside their authorization scope. No user interaction from a victim is required.

php

// Patch excerpt: app/Console/Command/CLIShell/cli_events.php
                    'threat_level_id', 'analysis',
                    'sharing_group_id',
                ],
+               'filters' => [
+                   'value', 'type', 'category', 'org',
+                   'orgc_id', 'tags', 'searchall',
+                   'from', 'to', 'last', 'eventid',
+                   'uuid', 'published',
+                   'threat_level_id', 'analysis',
+                   'timestamp', 'publish_timestamp',
+                   'order',
+               ],
            ],
        ];
    }

Source: MISP commit cd9f548ed. The change routes CLI queries through the same filter definitions and accessors used by the web layer.

php

// Patch excerpt: app/Console/Command/CLIShell/cli_organisations.php
                    'contacts', 'local',
                ],
                'writeAdminOnly' => true,
+               'filters' => [
+                   'searchall', 'nationality',
+                   'sector', 'local',
+                ],
            ],
        ];
    }

Source: MISP commit cd9f548ed.

Detection Methods for CVE-2026-90895

Indicators of Compromise

CLI process invocations of MISP shell commands (cake, Console/cake) issuing feeds, servers, or sharing_groups list/view actions by non-host-organisation accounts
Use of the CLI use command targeting record IDs the invoking user cannot access through the web UI
Unexpected reads of Feed.headers or server authkey fields in shell history or terminal logs

Detection Strategies

Compare CLI command audit logs against web-layer authorization decisions to surface accesses that would have been denied by FeedsController::view() or SharingGroup::checkIfAuthorised()
Alert on shell sessions launched by accounts outside the host organisation on MISP application hosts
Baseline normal CLI usage per operator and flag deviations that touch feed, server, or sharing-group detail endpoints

Monitoring Recommendations

Forward MISP CLI shell command history, auth.log, and process telemetry to a central logging pipeline for correlation
Monitor filesystem and terminal buffers for exposure of Authorization: headers or authkey strings originating from CLI output
Track version strings of MISP deployments and flag any host running ≤2.5.45

How to Mitigate CVE-2026-90895

Immediate Actions Required

Upgrade MISP to a fixed release containing commit cd9f548ed and confirm the version is greater than 2.5.45
Rotate all feed HTTP authorization credentials and server synchronization authkey values that may have been exposed through CLI output
Restrict shell access on MISP hosts to host-organisation administrators and site admins only

Patch Information

The fix routes interactive CLI shell authorization through the shared model accessors and hides sensitive fields from CLI serialization. Review the changes in the MISP GitHub commit cd9f548ed and apply the corresponding tagged release.

Workarounds

Remove interactive CLI shell access for users who are not members of the host organisation until the patch is applied
Enforce operating-system-level access control on the MISP application directory and Console/cake binary
Temporarily strip Feed.headers values and rotate server authkey entries if CLI access cannot be restricted

bash

# Restrict MISP CLI shell access to a dedicated admin group
sudo chown root:misp-admins /var/www/MISP/app/Console/cake
sudo chmod 750 /var/www/MISP/app/Console/cake

# Verify installed MISP version is patched
cd /var/www/MISP && git describe --tags