CVE-2026-90955
Received Received - Intake

CLI Audit Log Identity Loss in MISP

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: CIRCL

Description
Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90955
EUVD
EUVD-2026-77442

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.45 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-223 The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
CWE-778 When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects MISP's interactive CLI shell, where audit logs fail to reliably preserve the identity of the impersonated MISP user. The issue occurs because the shell's logging behavior stores user identity in a shared state that can be overwritten, leading to incorrect user attribution in logs. Additionally, CLI actions lack a marker, making them indistinguishable from web-based actions by the same user.

Detection Guidance

Check MISP audit logs for actions without proper user attribution or missing CLI markers. Look for inconsistencies where user IDs are not preserved across multiple CLI operations. Review logs for entries where actions appear to originate from web interfaces but are actually CLI-based.

Impact Analysis

This vulnerability could lead to incorrect audit logs where actions appear to be performed by the wrong user. It may also obscure whether actions were taken via the CLI or web interface, potentially hiding unauthorized or malicious activities. This impacts accountability and traceability of user actions in the system.

Compliance Impact

This vulnerability could undermine compliance by producing unreliable audit logs, which are critical for demonstrating adherence to regulations like GDPR and HIPAA. Incorrect or incomplete logs may fail to meet requirements for tracking user activity, data access, and accountability, potentially leading to compliance violations.

Mitigation Strategies

Upgrade MISP to version 2.5.46 or later to apply the fix. Ensure audit logs are reviewed for any misattributed or unmarked CLI actions. Configure the CurrentUserId setting to track impersonated users consistently.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90955. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart