CVE-2026-86408
Received Received - Intake

Information Disclosure in MISP CryptographicKeysController

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: CIRCL

Description
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as: * type * key_data * fingerprint but did not fetch or authorize the associated parent event first. The upstream commit explicitly states that cryptographicKeys/view could return a protected event’s signing key to any authenticated user. The fix adds parent_id and parent_type to the lookup and then enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86408
EUVD
EUVD-2026-72358

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
misp misp to 2.5.45 (inc)
misp misp to 2.5.45 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP (≤2.5.45) allows authenticated users to access cryptographic keys of protected events without proper authorization. The CryptographicKeysController::view() function did not check parent-event visibility before returning sensitive key data like type, key_data, and fingerprint.

Detection Guidance

To detect this vulnerability, check if your MISP instance is running a version ≤2.5.45. Use the command: misp --version or check the web interface under Administration > Server Settings. If the version is vulnerable, inspect the CryptographicKeysController::view() endpoint for improper authorization checks on parent events.

Impact Analysis

An attacker could exploit this to steal cryptographic keys from protected events, potentially decrypting sensitive data or impersonating legitimate users. The impact includes unauthorized access to confidential information and compromised system integrity.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (e.g., GDPR, HIPAA) by enabling unauthorized access to sensitive data. Organizations using affected MISP versions may face legal penalties, reputational damage, and loss of certification.

Mitigation Strategies

Immediately upgrade MISP to version >2.5.45. If upgrading is not possible, apply the upstream patch from commit 2edde619b. Ensure the cryptographicKeys/view endpoint enforces parent event visibility checks before returning keys. Restrict access to site administrators for non-event parent types.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart