CVE-2026-92002
Received Received - Intake

Authentication Failure Logging Disabled When Redis Unavailable in MISP

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: CIRCL

Description
Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User->setupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-92002
EUVD
EUVD-2026-78432

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
misp misp to 2.5.45 (inc)
misp misp to 2.5.45 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-778 When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects MISP versions 2.5.45 and earlier. It involves Redis being used to throttle repeated authentication-failure log entries. When Redis is unavailable, the system fails to log authentication failures at all because the _shouldLog() function returns false and prevents logging during Redis outages.

Detection Guidance

Check if Redis is unreachable during authentication attempts by monitoring network connectivity or Redis service status. Verify if authentication-failure logs are missing during Redis outages. Use system logs to confirm if _shouldLog() fails silently when Redis is down.

Impact Analysis

This vulnerability can impact you by preventing the logging of authentication failures when Redis is down. This means you may not detect unauthorized access attempts or security breaches during Redis outages, reducing visibility into potential security incidents.

Mitigation Strategies

Update MISP to version 2.5.46 or later to fix the _shouldLog() function behavior. Ensure Redis is properly configured and monitored to avoid outages. Review authentication logs regularly to confirm failures are being recorded even during Redis downtime.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92002. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart