CVE-2026-92002: MISP: Authentication failure logging suppressed during Redis unavailability
Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity.
However, User->setupRedis() returns false when Redis cannot be reached. The vulnerable shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in ≤2.5.45Patch MISP: Authentication failure logging suppressed during Redis unavailability - Configuration
Ensure MISP uses the updated _shouldLog() logic that explicitly checks whether the Redis connection is available before attempting to use it, so that when Redis is unavailable the system becomes fail-open for security logging (logs failed authentication events instead of silencing them).
MISP (Redis throttling for authentication-failure logging) Redis connection availability check in _shouldLog() = enabled
Event History
Frequently Asked Questions
When does the logging gap occur?
It occurs when MISP cannot reach Redis. During that Redis outage, failed authentication attempts are not written to the authentication-failure log.
What deployments are affected?
MISP versions 2.5.45 and earlier are affected. The issue depends on Redis becoming unavailable, because Redis is used to control repeated authentication-failure log entries.
How can administrators determine whether they may have missed authentication failures?
Review periods when the MISP instance could not reach Redis. Authentication failures occurring during those periods may have generated no authentication-failure log entries.