CVE-2026-92003
Received Received - Intake

Authentication Failure Logging Bypass in MISP

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: CIRCL

Description
Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model:  - API requests with no authentication key;  - requests supplying an API key with an incorrect length Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-92003
EUVD
EUVD-2026-78439

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-92003 affects MISP versions 2.5.45 and earlier. It involves two API authentication failure paths that bypassed the existing logging throttle. These paths logged every failed authentication attempt without rate limiting, allowing excessive log entries for requests with no API key or incorrect API key length.

Detection Guidance

Check MISP logs for excessive authentication failure entries, particularly from unauthenticated API requests or those with malformed API keys. Monitor for rapid log growth in auth_fail logs.

Impact Analysis

This vulnerability could lead to denial-of-service conditions by filling logs with excessive authentication failure entries. It may also obscure legitimate security events due to log flooding and consume significant storage or processing resources.

Mitigation Strategies

Upgrade MISP to version 2.5.46 or later to apply the fix that enforces throttling on all authentication failure logs. Ensure Redis is properly configured for rate limiting.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92003. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart