{"id":"CVE-2026-112188","kind":"vulnerability","aliases":["CVE-2026-112188"],"related":[],"title":"MISP: authenticated users can read redacted server secrets via settings lookup","description":"MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\n\nThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.\n\nA second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.\n\nThe impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.\n\nAffected versions: <2.5.48.","summary":"MISP's server settings lookup returns an entire configuration branch when given a branch name, skipping the redaction check. An authenticated user can therefore read secrets such as the security salt, Redis passwords and plugin API keys.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["misp","package","self-hosted","threat-intel"],"not_affected_if":["auth-required"],"how_to_check":"- Check the installed MISP version and compare it with `2.5.48`\n- Review whether non-admin accounts can reach the server settings endpoints","fix":"- Upgrade MISP to `2.5.48` or later\n- Rotate the security salt, Redis password and plugin API keys if exposure is suspected","status":"open","published_at":"2026-10-19T10:16:47+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:35:04+00:00","updated_at":"2026-10-25T03:35:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:35:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MISP to `2.5.48` or later\n- Rotate the security salt, Redis password and plugin API keys if exposure is suspected","reach":"network","title":"MISP: authenticated users can read redacted server secrets via settings lookup","impact":"high","summary":"MISP's server settings lookup returns an entire configuration branch when given a branch name, skipping the redaction check. An authenticated user can therefore read secrets such as the security salt, Redis passwords and plugin API keys.","category":"package","nicknames":[],"who_cares":["misp","self-hosted","threat-intel"],"confidence":0.7,"needs_auth":"yes","worst_case":"secrets readable by any authenticated user, including salt and passwords","analyst_note":"Confirm the fixed version and whether non-admin users can reach these endpoints by default, using the NVD entry and the MISP release notes.","how_to_check":"- Check the installed MISP version and compare it with `2.5.48`\n- Review whether non-admin accounts can reach the server settings endpoints","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Any MISP instance running a version below `2.5.48` is exposed to users who hold a valid account and can reach the server settings endpoints. Instances where only trusted administrators have accounts carry lower practical risk but should still be upgraded.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000606,"input_tokens":3531,"output_tokens":506,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112188':14A,17A '-2026':13A,16A '2.5.48':221C 'access':214C 'affect':219C 'allow':74C 'api':61B,173C 'authent':2A,46B,76C 'branch':35B,39B,106C,132C,153C,190C 'bypass':149C 'caller':159C,199C 'carri':136C 'check':44B,142C 'configur':34B,81C,102C,186C,207C 'connect':169C 'contain':64C 'content':154C 'cve':12A,15A 'data':82C 'disclosur':203C 'dot':94C 'edit':179C 'endpoint':147C,177C,218C 'entir':33B,126C,185C 'expos':161C 'flag':139C 'full':152C 'function':91C,123C 'given':37B 'host':22B 'impact':201C 'includ':164C 'instead':116C 'intel':25B 'key':62B,174C 'leaf':120C 'lookup':11A,30B,71C,90C 'mechan':72C 'misp':1A,18B,26B,63C,111C 'name':40B,96C,107C,191C 'node':99C,133C 'packag':19B 'password':58B,170C 'plugin':60B,113C,172C 'read':5A,50B,183C 'redact':6A,43B,87C,138C,141C 'redi':57B,168C 'resolv':92C,193C 'retriev':79C,146C 'return':31B,124C,156C,194C 'salt':56B,167C 'second':176C 'secret':8A,51B,208C 'secur':55B,110C,166C 'self':21B 'self-host':20B 'sensit':80C,162C,205C 'server':7A,28B,69C,180C,206C,216C 'set':10A,29B,70C,89C,95C,121C,145C,181C,196C,217C 'similar':182C 'skip':41B 'specif':119C 'store':187C 'sub':128C 'sub-tre':127C 'suppli':115C 'therefor':49B 'threat':24B 'threat-intel':23B 'tree':103C,129C 'user':3A,47B,77C,211C 'valu':163C 'version':220C 'via':9A 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Any MISP instance running a version below `2.5.48` is exposed to users who hold a valid account and can reach the server settings endpoints. Instances where only trusted administrators have accounts carry lower practical risk but should still be upgraded.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5a6e4751-2f3f-4070-9419-94fb35b644e8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112188","severity":null,"published_at":"2026-10-19T10:16:47+00:00","modified_at":"2026-10-19T10:16:47+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}