CVE-2026-86408 in MISP
Summary
by MITRE • 09/07/2026
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().
The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as:
* type
* key_data
* fingerprint
but did not fetch or authorize the associated parent event first.
The upstream commit explicitly states that cryptographicKeys/view could return a protected event’s signing key to any authenticated user.
The fix adds parent_id and parent_type to the lookup and then enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators.
Version affected: ≤2.5.45
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability in question represents a critical Authorization Bypass within the MISP platform, specifically affecting versions up to and including 2.5.45. This flaw resides in the CryptographicKeysController::view() handler, which is responsible for serving cryptographic keys such as signing or encryption certificates to authenticated users. The core technical deficiency lies in the data retrieval logic, where the application queries the database directly using a supplied key identifier without first validating the visibility permissions of the parent event associated with that key. By selecting sensitive fields including type, key_data, and fingerprint from the CryptographicKey table independently, the system fails to enforce the access control policies defined at the Event level. This architectural oversight allows any authenticated user who possesses or guesses a valid cryptographic key identifier to retrieve the full private signing keys or other sensitive material associated with that key, regardless of whether the parent event is marked as restricted, internal-only, or otherwise protected from public view.
From an operational impact perspective, this vulnerability compromises the confidentiality and integrity mechanisms provided by MISP’s threat intelligence sharing framework. Cryptographic keys are foundational to secure communications and digital signatures within the platform; their unauthorized disclosure enables attackers to impersonate trusted entities, forge signed reports, or decrypt sensitive data shared between organizations. The ability for any authenticated user to access these secrets undermines trust in the platform and could lead to significant reputational damage and operational disruption for participating members who rely on MISP for secure collaboration. This scenario aligns with CWE-284 Improper Access Control, as the application fails to properly restrict resource access based on user roles or event visibility settings. Furthermore, this exploitation technique maps to MITRE ATT&CK T1078 Valid Accounts and potentially T1539 Steal Web Session Cookie if combined with other vectors, but primarily represents a direct violation of authorization controls leading to sensitive information exposure.
The remediation for this issue involves modifying the controller logic to enforce hierarchical access control checks before serving any cryptographic material. The fix explicitly requires fetching the parent event using its identifier and type prior to retrieving key details. It utilizes the fetchSimpleEvent method with the current user context to verify that the user has legitimate permission to view the associated event. If the parent entity is not an Event, or if the user lacks authorization for that specific event, access to the cryptographic keys must be denied unless the requester holds site administrator privileges. This ensures that visibility rules defined at the event level are strictly propagated down to dependent resources like cryptographic keys. Organizations running affected versions should immediately upgrade to a patched release where this parent-child relationship is properly validated during every request to the view endpoint for cryptographic keys, thereby restoring the intended security posture of the platform.