CVE-2026-112192: MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and clionly flags that a module declares in its own configuration metadata.
As a result:
- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.
- A module that marks a setting as clionly (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.
An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.
Affected: <2.5.48
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can read server settings can retrieve sensitive values from module settings. An authenticated user with access to server settings can also modify settings intended to be restricted to the command-line interface.
Are API keys or other credentials at risk of disclosure?
Yes. Module settings marked as redacted, such as an API key, can be returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints when affected versions rebuild module-supplied settings for API use.
What access does an attacker need to change CLI-only module settings?
The attacker must be authenticated and have access to server settings. No user interaction is required, and the modification can be made through the web API despite the setting being designated cli_only by the module.
Which versions are affected?
MISP versions earlier than 2.5.48 are affected.