CVE-2026-86408: MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().
The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as:
type
keydata
fingerprint
but did not fetch or authorize the associated parent event first.
The upstream commit explicitly states that cryptographicKeys/view could return a protected event’s signing key to any authenticated user.
The fix adds parentid and parenttype to the lookup and then enforces authorization through the associated event using fetchSimpleEvent($user, parentid). If the parent is not an Event, access is limited to site administrators.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.5.45Patch MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events - Compensating control
Ensure CryptographicKeysController::view() enforces authorization for the cryptographic key by looking up parent_id and parent_type and then calling fetchSimpleEvent($user, parent_id) before returning sensitive fields (fingerprint, key_data, type) for protected events.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated MISP user could retrieve signing-key material from a protected event if they can request the affected cryptographic key view with its key ID. The issue does not require the user to be authorized to view the parent event.
What sensitive information may be exposed?
The vulnerable handler returned cryptographic key fields including the key type, key_data, and fingerprint. For protected events, this could expose the event's signing key.
Are non-event cryptographic key parents handled differently by the fix?
Yes. The fix authorizes Event-backed keys through the associated parent event. If a key's parent is not an Event, access is restricted to site administrators.
How can I determine whether an installation is affected?
MISP versions 2.5.45 and earlier are affected. The vulnerable behavior is present when CryptographicKeysController::view() looks up a CryptographicKey by supplied key ID and returns sensitive fields without first authorizing access to its parent event.