CVE-2026-56447: MISP remote code execution via arbitrary rdkafka configuration path
MISP allowed an authenticated site administrator to set the Kafkardkafkaconfig setting to an arbitrary filesystem path. MISP subsequently parsed the referenced INI file and passed its options to rdkafka. A crafted attacker-controlled configuration file could use rdkafka options such as plugin.library.paths to load an external library, resulting in arbitrary code execution with the privileges of the MISP process. An attacker could leverage a MISP-writable location, such as an uploaded file or administrative image, to host the malicious configuration file.
The issue is fixed by restricting the setting to absolute .ini files located only in approved configuration directories outside the webroot and MISP upload targets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict the Kafka_rdkafka_config setting so it only accepts absolute filesystem paths to .ini files located in approved configuration directories that are outside the webroot and any MISP-writable upload or administrative image locations.
MISP Kafka_rdkafka_config = absolute path to a .ini file located only in approved configuration directories outside the webroot and MISP upload targets - Compensating control
Ensure MISP-writable locations (upload directories, administrative image directories, etc.) cannot be used to host configuration files: remove write permissions where not required, block uploads of .ini files, and ensure those directories are isolated from approved configuration directories so rdkafka cannot load libraries from them.
- Operational
Audit current Kafka_rdkafka_config values and any referenced INI files; verify each referenced .ini is an absolute path located in an approved configuration directory outside the webroot and MISP upload targets. Remove or relocate any unapproved or suspicious INI files and update the setting to point only to approved files.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56447?
The severity of CVE-2026-56447 is rated at 66, indicating a moderate risk level.
How do I fix CVE-2026-56447?
To fix CVE-2026-56447, ensure that only trusted site administrators can configure the Kafka_rdkafka_config setting and validate file paths for configuration files.
What type of vulnerability is CVE-2026-56447?
CVE-2026-56447 is a remote code execution vulnerability due to unsecured configuration path settings in MISP.
Who is affected by CVE-2026-56447?
Authenticated site administrators using MISP are potentially at risk from CVE-2026-56447 if proper access controls are not enforced.
How does CVE-2026-56447 allow remote code execution?
CVE-2026-56447 allows remote code execution by enabling an administrator to specify an arbitrary filesystem path for configuration, which can then be manipulated by an attacker.