CVE-2026-95667: MISP Installer Information Disclosure Flaw

CVE-2026-95667 Overview

CVE-2026-95667 is an information disclosure vulnerability in the Malware Information Sharing Platform (MISP) installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4. The installer writes highly sensitive setup data to /var/log/misp_install.log and a companion named pipe at /var/log/misp_install.log.pipe. Both objects inherit the system default umask, leaving them world-readable (typically 0644). The log captures the generated admin password, database passwords, GPG passphrase, and supervisor password. Any local unprivileged user on the host can read these credentials. The issue is tracked under [CWE-22] and affects MISP versions prior to 2.5.47.

Critical Impact
Local unprivileged users can harvest admin, database, GPG, and supervisor credentials from world-readable installer artifacts, and a pre-existing symlink in /var/log can redirect the log write to an arbitrary file.

Affected Products

MISP installer on Debian 12 (INSTALL/INSTALL.debian12.sh)
MISP installer on Debian 13 (INSTALL/INSTALL.debian13.sh)
MISP installer on Ubuntu 24.04 and RHEL 9.4, all versions prior to 2.5.47

Discovery Timeline

2026-09-22 - CVE-2026-95667 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95667

Vulnerability Analysis

The MISP installer streams all setup output through a FIFO into a log file so administrators can review installation results. The script creates the FIFO with mkfifo ${logfile}.pipe and lets tee create /var/log/misp_install.log without an explicit mode. Both objects therefore inherit the process umask, which on stock Debian, Ubuntu, and RHEL installations produces mode 0644. The stream carries the generated admin password, MariaDB/MySQL credentials, the GPG passphrase, and the supervisor password.

A local unprivileged user can cat /var/log/misp_install.log during and after installation to obtain full administrative credentials for the MISP instance and its backing services. The FIFO is world-readable during the brief window before it is unlinked, giving a racing reader access to the same stream in real time.

Root Cause

The root cause is missing explicit permission control at object creation. mkfifo was invoked without -m, and the log file was created implicitly by tee rather than by install -m 0600. Additionally, the script did not remove any pre-existing /var/log/misp_install.log before writing, so an attacker who could place a symlink in /var/log before the installer ran could redirect the write to an arbitrary path chosen by the attacker, aligning with the CWE-22 path traversal classification.

Attack Vector

Exploitation requires local, unprivileged access to the host during or after installation. No authentication to MISP itself is required, and no user interaction is needed. The disclosed database and admin credentials can then be reused against the MISP web interface, the database service, or the GPG keyring, enabling full compromise of the threat-intelligence platform.

bash

# Patched installer snippet from INSTALL/INSTALL.debian12.sh and INSTALL.debian13.sh
# Source: https://github.com/MISP/MISP/commit/d5d72ab38

logfile=/var/log/misp_install.log
# The file is removed first so the mode is never applied through a symlink
# left in /var/log, and the FIFO is created restricted too.
rm -f "$logfile"
install -m 0600 /dev/null "$logfile"
mkfifo -m 0600 ${logfile}.pipe
tee < ${logfile}.pipe $logfile &
exec &> ${logfile}.pipe
rm ${logfile}.pipe

The patch removes any pre-existing file, creates the log with mode 0600 via install, and passes -m 0600 to mkfifo so neither artifact is ever world-readable.

Detection Methods for CVE-2026-95667

Indicators of Compromise

Presence of /var/log/misp_install.log with permissions of 0644 or any world-readable mode on hosts running MISP versions earlier than 2.5.47.
Access records in auditd or filesystem audit logs showing non-root UIDs opening /var/log/misp_install.log or /var/log/misp_install.log.pipe.
Unexpected symlinks in /var/log pointing to sensitive files such as /etc/shadow or configuration files under /etc.
MISP admin, database, GPG, or supervisor credential reuse from unfamiliar source IPs shortly after installation.

Detection Strategies

Audit MISP hosts for the existence and permissions of /var/log/misp_install.log using stat -c '%a %n' /var/log/misp_install.log.
Enable auditd rules on /var/log/misp_install.log* to record every non-root read attempt.
Compare the installed MISP version against 2.5.47 and flag any host below that version for remediation.

Monitoring Recommendations

Alert on any open() or read() syscall against MISP installer log artifacts by UIDs other than 0.
Monitor for creation of symbolic links in /var/log by non-root processes, particularly before scheduled MISP upgrades or re-installations.
Rotate and monitor MISP admin, database, GPG, and supervisor credentials for anomalous authentication events from unexpected hosts.

How to Mitigate CVE-2026-95667

Immediate Actions Required

Upgrade MISP to version 2.5.47 or later, which ships the corrected installer scripts.
Rotate the MISP admin password, database credentials, GPG passphrase, and supervisor password on any host installed with a vulnerable script.
Delete or restrict /var/log/misp_install.log and any residual /var/log/misp_install.log.pipe with chmod 0600 and chown root:root.
Inspect /var/log for attacker-controlled symlinks that may have redirected earlier installer output.

Patch Information

The fix is delivered in MISP commit d5d72ab38, included in MISP 2.5.47. The patch removes any pre-existing logfile with rm -f, creates it via install -m 0600 /dev/null "$logfile", and enforces mode 0600 on the FIFO with mkfifo -m 0600. This ensures both artifacts are root-only from the moment they exist and prevents symlink redirection of the installer output.

Workarounds

On unpatched hosts, run the installer with a restrictive umask such as umask 077 before invoking the script so newly created files default to 0600.
Manually pre-create /var/log/misp_install.log as root with mode 0600 before running the installer to preempt symlink hijacking.
Restrict local shell access on MISP servers to trusted administrators until the upgrade is applied.