CVE-2026-92003: MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion
Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.
Two API authentication failure branches wrote directly to the Log model:
- API requests with no authentication key; - requests supplying an API key with an incorrect length
Unlike other authentication failures, these paths bypassed shouldLog(), so every request could create another durable authfail entry.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in ≤2.5.45
Event History
Frequently Asked Questions
Which requests can trigger the excessive log writes?
The affected paths are API requests with no authentication key and API requests that provide an API key of an incorrect length. Each such request can create a durable auth_fail log entry because these branches bypass the authentication-failure logging throttle.
Are deployments affected by this issue without a valid API key?
Yes. Requests with no authentication key are one of the affected API authentication-failure branches, so an attacker does not need a valid API key to trigger log writes through that path.
What versions are affected?
MISP versions 2.5.45 and earlier are affected.