CVE-2026-95667
Deferred Deferred - Pending Action

Information Disclosure in MISP Installer Scripts

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CIRCL

Description
The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked.  Any local unprivileged user on the system could read the log file or the FIFO to obtain these credentials.  Additionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location. Version affected: <2.5.47

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95667
EUVD
EUVD-2026-84379

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.47 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves MISP installer scripts creating a log file and named pipe with world-readable permissions. Sensitive data like admin passwords, database passwords, GPG passphrases, and supervisor passwords were logged in these files. The issue occurred because the files were created with default umask permissions (typically 0644), allowing any local user to read them. Additionally, a pre-existing symlink could redirect writes to an arbitrary location.

Detection Guidance

Check for the existence of /var/log/misp_install.log and /var/log/misp_install.log.pipe with world-readable permissions (0644). Verify if sensitive credentials were exposed by inspecting the log file content. Commands: ls -la /var/log/misp_install.log /var/log/misp_install.log.pipe; cat /var/log/misp_install.log

Impact Analysis

An unprivileged local user could exploit this to read sensitive credentials, gaining unauthorized access to the MISP system, databases, or encrypted data. This could lead to data breaches, privilege escalation, or further compromise of the system or network.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (e.g., GDPR, HIPAA) due to unauthorized exposure of sensitive credentials and potential data breaches. It undermines confidentiality controls and could result in regulatory penalties or legal consequences.

Mitigation Strategies

Remove the vulnerable log file and FIFO immediately: rm -f /var/log/misp_install.log /var/log/misp_install.log.pipe. Rotate all exposed credentials (admin, database, GPG, supervisor passwords). Update MISP to version 2.5.47 or later to apply the security fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart