CVE-2026-95674: MISP Authentication Bypass Vulnerability

CVE-2026-95674 Overview

CVE-2026-95674 is an input validation vulnerability [CWE-20] in MISP (Malware Information Sharing Platform), an open-source threat intelligence platform. The flaw resides in the queryEnrichment method within EventsController.php. The method accepts a module name parameter and iterates over enabled modules to find a match. When the supplied module is absent from the enabled list, the code silently continues with default parameters instead of rejecting the request. Authenticated users can trigger enrichment or analysis processing through modules the administrator has not authorized. This bypasses the intended module availability controls in MISP.

Critical Impact
Authenticated users can invoke enrichment processing paths outside the administrator-approved module set, exposing unauthorized data processing functionality.

Affected Products

MISP (Malware Information Sharing Platform)
app/Controller/EventsController.php component
MISP instances prior to commit 7dfcc4d32

Discovery Timeline

2026-09-22 - CVE CVE-2026-95674 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95674

Vulnerability Analysis

The queryEnrichment method in EventsController.php performs module name matching by iterating over the $enabledModules['modules'] array. The original implementation initializes $format = 'simplified' before the loop and only updates configuration when a module name matches. If no match is found, execution proceeds using the default format with no module-specific configuration applied.

This behavior violates the module availability contract. Administrators expect that disabling a module prevents its invocation. Instead, requests referencing arbitrary module names continue through the processing pipeline. The absence of a rejection path means authorization decisions encoded in the enabled module list are not enforced at the request handling layer.

Root Cause

The root cause is missing input validation [CWE-20]. The controller lacks a boolean flag indicating whether the requested module was found, and it lacks a post-loop check to reject unknown modules. Default variable initialization masks the failure condition.

Attack Vector

An authenticated user submits an enrichment request specifying a module name that is not present in the enabled modules list. The server processes the request with default parameters rather than returning an error. This grants access to processing paths outside the administrator-sanctioned configuration.

php

// Security patch from commit 7dfcc4d32 - EventsController.php
$this->set('sourceId', $id);
$options = [];
$format = 'simplified';
$moduleFound = false;
foreach ($enabledModules['modules'] as $temp) {
    if ($temp['name'] == $module) {
        $moduleFound = true;
        $format = !empty($temp['mispattributes']['format']) ? $temp['mispattributes']['format'] : 'simplified';
        if (isset($temp['meta']['config'])) {
            foreach ($temp['meta']['config'] as $conf) {
                // configuration processing

Source: GitHub MISP Commit 7dfcc4d32. The patch introduces a $moduleFound boolean flag that allows the controller to reject requests referencing modules outside the enabled list.

Detection Methods for CVE-2026-95674

Indicators of Compromise

Requests to MISP enrichment endpoints referencing module names that do not appear in the instance's enabled modules configuration.
Enrichment processing entries in application logs where the module parameter does not match any configured module.
Unexpected invocations of queryEnrichment from authenticated user sessions targeting disabled or nonexistent modules.

Detection Strategies

Audit MISP application logs for enrichment requests and correlate the module parameter against the current enabled modules list.
Review authenticated user activity for repeated calls to EventsController::queryEnrichment with varying module name values, which may indicate probing.
Enable verbose logging on the MISP modules service to capture requests dispatched from the controller for later analysis.

Monitoring Recommendations

Instrument web application firewall rules to flag enrichment endpoint requests carrying module parameters outside an allowlist derived from the MISP configuration.
Track authentication events alongside enrichment requests to identify low-privilege accounts triggering unusual processing paths.
Forward MISP access and application logs to a centralized log platform for correlation and long-term retention.

How to Mitigate CVE-2026-95674

Immediate Actions Required

Apply the upstream patch from commit 7dfcc4d32 or upgrade to the MISP release that incorporates the fix.
Restrict enrichment endpoint access to trusted authenticated roles until the patch is deployed.
Review the enabled modules list and remove any modules that are not required for operations.

Patch Information

The fix is contained in MISP commit 7dfcc4d32, titled "fix: [security] Harden misp modules module choice requirements." The patch adds a $moduleFound flag and enforces rejection of requests that reference modules outside the enabled set. Administrators should upgrade to the MISP release containing this commit.

Workarounds

Place the MISP enrichment endpoint behind an authenticated reverse proxy that validates the module request parameter against an allowlist.
Temporarily disable the MISP modules integration by unsetting Plugin.Enrichment_services_enable in the MISP configuration.
Limit user roles that can trigger enrichment requests to reduce the population of accounts capable of exploiting the flaw.

bash

# Verify installed MISP version includes the patch
cd /var/www/MISP
git log --oneline | grep 7dfcc4d32

# If missing, fetch and apply the fix
git fetch origin
git cherry-pick 7dfcc4d32