Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112192— MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 在处理模块插件设置时存在漏洞。当服务器为 API 调用重新构建模块提供的设置时，会丢弃模块在其自身配置元数据中声明的 （脱敏）和 （仅限命令行）标志。 由此导致以下后果： 若模块将某个设置（例如 API 密钥）标记为 ，该设置的值仍会通过 和 接口以完整形式返回，从而将敏感凭据暴露给任何有权读取服务器设置的已认证用户。 若模块将某个设置标记为 （本意是仅允许通过命令行界面修改），该设置仍可通过 Web API 进行修改，从而绕过原本设定的访问限制。 因此，任何拥有服务器设置访问权限的已认证用户，均可读取敏

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112192

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
Source: CVE Program / CVE List V5
Vulnerability Description
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata. As a result: - A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings. - A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction. An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access. Affected: <2.5.48
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.48 cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-112192

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112192

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112192 (1)

Same Patch Batch · MISP · 2026-10-19 · 7 CVEs total

CVE-2026-112178 7.1 HIGH MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access C
CVE-2026-112188 7.1 HIGH MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolutio
CVE-2026-112179 5.3 MEDIUM MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
CVE-2026-112180 5.1 MEDIUM MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
CVE-2026-112184 4.8 MEDIUM MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Lab
CVE-2026-112183 4.8 MEDIUM MISP CSS Injection via Remote Tag Colour in Event Preview

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-200

V. Comments for CVE-2026-112192

No comments yet

Leave a comment