Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112188— MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 的服务器设置查找机制中存在一个漏洞，允许已认证用户获取本应被隐去的敏感配置数据。 设置查找功能将带点的设置名称解析为配置树中的某个节点。当传入的是分支名称（例如 Security、MISP 或 Plugin）而非具体的叶节点设置时，该函数会返回整个子树。由于分支节点本身不携带隐去标记，设置检索端点中的隐去检查会被绕过，导致完整的分支内容被返回给调用者。这会暴露包括安全盐值（security salt）、Redis 连接密码以及插件 API 密钥在内的敏感信息。 另一个用于编辑服务器设置的端点也存在类似问题

CVSS 7.1 · High EPSS 0.27% · P18

Affected Version Matrix 1

VendorProduct Version RangeStatus
MISP MISP < 2.5.48 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112188

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
Source: CVE Program / CVE List V5
Vulnerability Description
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys. A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller. The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints. Affected versions: <2.5.48.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.48 cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-112188

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112188

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112188 (1)

Same Patch Batch · MISP · 2026-10-19 · 8 CVEs total

CVE-2026-112178 7.1 HIGH MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access C
CVE-2026-112991 6.3 MEDIUM MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()
CVE-2026-112179 5.3 MEDIUM MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
CVE-2026-112192 5.3 MEDIUM MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Setting
CVE-2026-112180 5.1 MEDIUM MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
CVE-2026-112184 4.8 MEDIUM MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Lab
CVE-2026-112183 4.8 MEDIUM MISP CSS Injection via Remote Tag Colour in Event Preview

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-200

V. Comments for CVE-2026-112188

No comments yet

Leave a comment