CVE-2026-112192 in MISP
Summary
by MITRE • 10/19/2026
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.
As a result:
- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.
- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.
An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.
Affected: <2.5.48
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability in MISP versions prior to 2.5.48 represents a critical failure in input validation and data sanitization logic within the server-side handling of module plugin configurations. This flaw arises specifically during the process where the application reconstructs module-supplied settings for consumption via its REST API endpoints, namely servers/getSetting and servers/serverSettingsEdit. The core technical deficiency lies in the omission of metadata filtering steps that are intended to enforce security boundaries defined by module authors. When a module declares specific configuration parameters as redacted or cli_only within its own configuration metadata, these flags serve as directives for how the data should be treated during serialization and transmission. However, the server fails to respect these declarations when building the response payload, resulting in a breakdown of the intended security model for plugin management.
The operational impact of this flaw is twofold, affecting both confidentiality and integrity through distinct attack vectors. First, regarding confidentiality, modules often handle sensitive credentials such as API keys or authentication tokens by marking them with a redacted flag. This designation typically instructs the system to mask these values in user-facing interfaces to prevent accidental exposure. Due to this vulnerability, the server ignores the redaction directive and returns the full plaintext value of these secrets through the API endpoints accessible to authenticated users. Consequently, any attacker who has obtained valid authentication credentials for a MISP instance can query these settings to extract sensitive module configurations, leading to unauthorized access to external services or systems integrated with MISP via those modules.
Second, regarding integrity and access control bypass, the vulnerability allows for the modification of settings that are explicitly marked as cli_only. These flags indicate that certain configuration parameters should only be editable through command-line interfaces, often because they require elevated privileges, complex formatting, or specific environmental contexts not available in a web browser interface. By ignoring this restriction, the API endpoints allow authenticated users to alter these restricted settings via HTTP requests. This bypasses administrative controls designed to prevent accidental misconfiguration or unauthorized changes by lower-privileged accounts that might have read access but should not possess write access for critical system parameters.
This vulnerability maps directly to CWE-209, which describes the generation of an error message that includes sensitive information, as well as CWE-732, concerning incorrect permission assignment for privileged functions. The ability to extract secrets aligns with ATT&CK technique T1530, Data from Local System, while the unauthorized modification of restricted settings corresponds to T1484, Domain Policy Modification or similar privilege escalation patterns depending on the specific module context. The root cause is a lack of strict adherence to metadata-driven security policies during data serialization, highlighting a gap in how application-level permissions are enforced against API responses and input handlers.
Mitigation for this vulnerability requires an immediate upgrade to MISP version 2.5.48 or later, where the server logic has been corrected to properly filter redacted fields from API responses and enforce cli_only restrictions on write operations. In environments where upgrading is not immediately feasible, administrators should restrict access to the servers/getSetting and servers/serverSettingsEdit endpoints by implementing strict role-based access control that limits these actions to high-privilege accounts only. Additionally, auditing logs for unusual queries against module settings can help detect exploitation attempts before sensitive data is exfiltrated or critical configurations are altered.