CVE-2026-112188: MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.
The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.
A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.
The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.
Affected versions: <2.5.48.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user who can access the server settings endpoints can retrieve sensitive configuration data. Exploitation does not require user interaction.
What information could be exposed?
Exposed branch contents can include the security salt, Redis connection passwords, and plugin API keys, along with other settings in the returned configuration subtree.
What input is required to trigger the disclosure?
The user supplies a branch name, such as Security, MISP, or Plugin, rather than a specific leaf setting. Resolving that name returns the full subtree and bypasses the leaf-level redaction check.
Are systems running the default configuration affected?
The provided data does not identify a configuration prerequisite. The issue affects vulnerable MISP versions when an authenticated user can access the relevant server settings endpoints.
Which versions are affected?
MISP versions earlier than 2.5.48 are affected.