CVE-2026-112188
Deferred Deferred - Pending Action

MISP Server Settings Disclosure via Branch Lookup

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CIRCL

Description
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys. A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller. The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints. Affected versions: <2.5.48.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112188
EUVD
EUVD-2026-104150

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MISP MISP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MISP has a vulnerability where authenticated users can retrieve sensitive configuration data that should be hidden. The issue occurs in the server settings lookup function, which returns entire configuration branches (like Security or Plugin) instead of specific settings. Since branches lack redaction flags, sensitive values such as security salts, Redis passwords, and plugin API keys are exposed through endpoints like servers/getSetting and servers/serverSettingsEdit.

Detection Guidance

Check MISP server settings endpoints for exposed sensitive data by accessing URLs like /servers/getSetting or /servers/serverSettingsEdit with branch names such as Security, MISP, or Plugin. If full subtree data including salts, passwords, or API keys is returned, the system is vulnerable.

Impact Analysis

This vulnerability allows any authenticated user to access sensitive server configuration secrets, including passwords and API keys. Attackers could use this information to gain further access, compromise the system, or escalate privileges. The impact is limited to users with existing authentication but could lead to severe data breaches or unauthorized system control.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive configuration data. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. Exposure of security salts, Redis passwords, and plugin API keys undermines these requirements by allowing unauthorized access to systems handling regulated data.

Mitigation Strategies

Upgrade MISP to version 2.5.48 or later to apply the fix that prevents branch node resolution in settings lookups. Temporarily restrict access to server settings endpoints until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112188. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart