CVE-2026-90955: MISP CLI Audit Logging Vulnerability

CVE-2026-90955 Overview

CVE-2026-90955 affects the Malware Information Sharing Platform (MISP) interactive Command-Line Interface (CLI) shell. The interactive CLI shell fails to reliably preserve the identity of the impersonated MISP user across audit logging operations. The shell runs actions under a supplied MISP user ID, but the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Subsequent CLI writes lost the intended user attribution and were logged incorrectly. CLI-originated records also lacked a CLI marker, making them appear identical to ordinary web actions performed by that user. The issue is tracked under [CWE-223: Omission of Security-relevant Information].

Critical Impact
Audit logs written from the MISP interactive CLI shell can be attributed to the wrong user and cannot be distinguished from web-originated actions, undermining forensic integrity and accountability.

Affected Products

MISP (Malware Information Sharing Platform) versions ≤ 2.5.45
MISP app/Console/Command/CLIShell.php interactive shell component
MISP SysLogLogable audit logging behavior

Discovery Timeline

2026-09-14 - CVE-2026-90955 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90955

Vulnerability Analysis

The MISP interactive CLI shell is designed to execute privileged actions on behalf of an impersonated MISP user. Audit logging depends on that user identity being propagated to every write. The legacy SysLogLogable audit engine is implemented as a CakePHP behavior. Behaviors in CakePHP are singletons shared across model instances. The CLI shell set the impersonated user on already-loaded behavior instances. When another model was lazily loaded, its setup() invocation rewrote the shared identity state on that singleton behavior. Any subsequent CLI writes were then attributed to a stale or incorrect user in the audit log. The problem is compounded because CLI-originated records were not tagged as CLI actions, so reviewers could not distinguish them from actions performed through the web UI.

Root Cause

The root cause is state stored on a shared singleton behavior instance rather than in a request-scoped context. The fix publishes the impersonated account through CurrentUserId, which both the newer AuditLog engine and other console shells resolve at write time. SysLogLogable also consumes the same identity through its own static resolver, so lazy model loads no longer clobber the attribution.

Attack Vector

Exploitation requires local access with high privileges — specifically the ability to invoke the MISP interactive CLI shell. An operator with legitimate CLI access can cause audit records to be attributed to the wrong MISP user, and CLI writes generally cannot be distinguished from web-originated activity by that user. The flaw enables audit trail tampering by omission rather than direct data compromise.

php

// Patch excerpt from app/Console/Command/CLIShell/cli_common.php
trait CLICommonTrait
{
    /**
     * Publish the impersonated account to both
     * audit engines, once, before any write.
     *
     * `CurrentUserId` is what AuditLog (the new
     * engine) and every other console shell use;
     * it also feeds the non-audit readers - tag
     * numerical-value overrides, workflow
     * initiator, analyst-data author - so they
     * see the impersonated user as the web would.
     * SysLogLogable (the default engine) takes the
     * same identity through its own static, which
     * it resolves at write time; setting it on the
     * loaded models' behaviour instances, as this
     * once did, was undone by the first lazy model
     * load, because the behaviour is a singleton
     * whose setup() rewrote the shared identity.
     *
     * @param array $user The impersonated user record
     * @return void
     */
    private function __setUserContext(array $user)
    {
        // ... fixed implementation publishes identity
        // via CurrentUserId consumed at write time
    }
}
// Source: https://github.com/MISP/MISP/commit/d13e5db33

Detection Methods for CVE-2026-90955

Indicators of Compromise

Audit log entries attributed to a MISP user who was not logged into the web interface at the time of the recorded action.
Bursts of write actions attributed to a single user within a very short window, without a corresponding web session in access_logs.
MISP versions at or below 2.5.45 running interactive CLI shell sessions without CLI markers in the resulting audit records.

Detection Strategies

Correlate MISP audit log entries against web access logs and system authentication records to identify writes that lack a matching HTTP session.
Review shell history and process accounting on MISP application servers for invocations of the interactive CLI shell (CLIShell) alongside affected audit windows.
Compare user_id fields on audit records against active MISP web sessions during the same timestamp range to detect misattribution.

Monitoring Recommendations

Enable operating system-level auditing on the MISP application server to record every invocation of Console/cake and the interactive CLI shell.
Forward MISP audit logs and host process telemetry to a centralized log platform for long-term correlation and integrity review.
Alert on any post-upgrade audit log entries that still lack CLI markers when the originating process is the console shell.

How to Mitigate CVE-2026-90955

Immediate Actions Required

Upgrade MISP to a version above 2.5.45 that includes commit d13e5db33.
Restrict shell and operating system access on the MISP application host to the minimum set of trusted administrators.
Review recent audit logs from CLI-active periods to identify any writes that may have been misattributed prior to patching.

Patch Information

The upstream fix is provided in the MISP repository commit d13e5db33, titled "fix: [cli] Attribute interactive CLI shell writes stably and mark them as CLI". The patch loads SysLogLogableBehavior explicitly in app/Console/Command/CLIShell.php, revises __setUserContext in app/Console/Command/CLIShell/cli_common.php to publish the impersonated account through CurrentUserId, and marks CLI-originated audit records so they can be distinguished from web actions.

Workarounds

Limit use of the interactive CLI shell to break-glass scenarios until the patched version is deployed.
Require a dedicated, named service account per operator when running CLI actions, and maintain out-of-band records mapping session to operator.
Enable host-level command auditing so CLI activity can be reconstructed independently of MISP audit logs.

bash

# Upgrade MISP to a patched release including commit d13e5db33
cd /var/www/MISP
sudo -H -u www-data git fetch --tags
sudo -H -u www-data git checkout <patched-tag-above-2.5.45>
sudo -H -u www-data git submodule update --init --recursive
sudo -H -u www-data app/Console/cake Admin runUpdates