CVE-2026-86408: MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().
The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as:
type
keydata
fingerprint
but did not fetch or authorize the associated parent event first.
The upstream commit explicitly states that cryptographicKeys/view could return a protected event’s signing key to any authenticated user.
The fix adds parentid and parenttype to the lookup and then enforces authorization through the associated event using fetchSimpleEvent($user, parentid). If the parent is not an Event, access is limited to site administrators.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.45 - Configuration
Update the CryptographicKeysController::view() handler to include parent_id and parent_type in the lookup, then enforce authorization through the associated event by calling fetchSimpleEvent($user, parent_id) before selecting and returning sensitive fields (fingerprint, key_data, type).
MISP CryptographicKeysController::view() Authorization/lookup logic = Enforce authorization via associated parent event using parent_id/parent_type and fetchSimpleEvent($user, parent_id) before returning key_data (signing keys)