CVE-2026-92003

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-15

Last updated on: 2026-09-16

Assigner: CIRCL

Description

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-16

Generated

2026-10-19

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92003

EUVD

EUVD-2026-78439

Affected Vendors & Products

Vendor	Product	Version / Range
MISP	MISP	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-92003 affects MISP versions 2.5.45 and earlier. It involves two API authentication failure paths that bypassed the existing logging throttle. These paths logged every failed authentication attempt without rate limiting, allowing excessive log entries for requests with no API key or incorrect API key length.

Detection Guidance

Check MISP logs for excessive authentication failure entries, particularly from unauthenticated API requests or those with malformed API keys. Monitor for rapid log growth in auth_fail logs.

Impact Analysis

This vulnerability could lead to denial-of-service conditions by filling logs with excessive authentication failure entries. It may also obscure legitimate security events due to log flooding and consume significant storage or processing resources.

Compliance Impact

This vulnerability could lead to excessive logging of authentication failures, potentially creating large volumes of sensitive log data. Under GDPR, this may impact data minimization and storage limitation principles if logs contain personal data. For HIPAA, excessive logging might complicate audit log management and increase the risk of exposing protected health information.

Mitigation Strategies

Upgrade MISP to version 2.5.46 or later to apply the fix that enforces throttling on all authentication failure logs. Ensure Redis is properly configured for rate limiting.

Hi! I’m here to help you understand CVE-2026-92003. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70