CVE-2026-95667 in MISP
Summary
by MITRE • 09/22/2026
The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked.
Any local unprivileged user on the system could read the log file or the FIFO to obtain these credentials.
Additionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location.
Version affected: <2.5.47
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability described involves a critical information disclosure flaw within the MISP installation scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 versions prior to 2.5.47. During the installation process, the script utilizes the tee command to capture all installer output into a log file located at /var/log/misp_install.log, alongside creating a named pipe or FIFO at /var/log/misp_install.log.pipe for real-time output streaming. The core technical flaw lies in the failure to restrict file permissions appropriately during this creation process. Both the log file and the FIFO inherit the system default umask, which typically results in world-readable permissions such as 0644 for files. This configuration allows any local unprivileged user on the operating system to read these artifacts without authentication or elevated privileges.
The operational impact of this vulnerability is severe due to the nature of data contained within the log file and accessible via the FIFO. The installation process generates highly sensitive credentials including the initial admin password, database passwords, GPG passphrases, and supervisor passwords. Because these files are world-readable, any local user can extract these secrets immediately after they are written during installation. This effectively compromises the security of the entire MISP instance from its inception, as attackers with low-level access to the host system can harvest credentials that provide full administrative control over the threat intelligence platform. The presence of GPG passphrases is particularly dangerous as it may allow decryption of sensitive data stored within the application if key management relies on these values.
Furthermore, a secondary vulnerability exists regarding file handling practices during installation. The log file was not removed or checked for existence prior to creation by the tee command. This oversight creates an opportunity for symlink attacks. If an attacker can create a symbolic link at /var/log/misp_install.log pointing to an arbitrary location on the filesystem before running the installer, the sensitive credential data will be written to that target path instead of the intended log file. This mechanism allows local users to exfiltrate credentials not only by reading the final state but also by intercepting them during the write process, potentially writing them to locations where they have read access or using it for further privilege escalation attacks against other services running on the system.
From a classification perspective, this vulnerability aligns with CWE-732: Incorrect Permission Assignment for Critical Resource and CWE-59: Improper Link Resolution Before File Access. The exposure of sensitive information through insecure default permissions is also categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1083: File and Directory Discovery, as attackers would enumerate accessible files in /var/log, and potentially T1564.007: Hidden Files and Directories if symlinks are used for redirection. The failure to sanitize or restrict access during the setup phase represents a fundamental lapse in secure coding practices common in automated deployment scripts that prioritize convenience over security hardening.
To mitigate this vulnerability, it is imperative to upgrade MISP to version 2.5.47 or later where these issues have been addressed. For systems running affected versions before an update can be applied, immediate remediation steps should include manually deleting the /var/log/misp_install.log file and removing the FIFO at /var/log/misp_install.log.pipe if they still exist. Administrators must then rotate all credentials that were potentially exposed during installation, including changing the admin password, updating database passwords, regenerating GPG keys or passphrases, and resetting supervisor passwords. Future installations should ensure that sensitive data is never written to world-readable files by explicitly setting restrictive umask values such as 077 before creating log files or using secure temporary directories with restricted permissions for capturing installation output.