CVE-2026-95667: MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/mispinstall.log and a named pipe (FIFO) at /var/log/mispinstall.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked.
Any local unprivileged user on the system could read the log file or the FIFO to obtain these credentials.
Additionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location.
Version affected: <2.5.47
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISP installerto a version that resolves this vulnerability.Fixed in 2.5.47
Event History
Frequently Asked Questions
Who can exploit this issue?
Any local unprivileged user on a system where the affected installer is running can read the world-readable installer log or FIFO and obtain credentials. The affected installer scripts are for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4.
What credentials could be exposed?
Installer output can include the generated MISP admin password, database passwords, GPG passphrase, and supervisor password. An attacker who reads the log or FIFO during installation may obtain these values.
Are systems affected after installation has completed?
The log file at /var/log/misp_install.log remains a concern because it contains sensitive installer output and was typically created with world-readable permissions. The FIFO exposure exists during the period before /var/log/misp_install.log.pipe is unlinked.
How can I check whether credentials may already have been exposed?
Check whether /var/log/misp_install.log exists and whether it is readable by non-privileged users, typically with permissions such as 0644. Also determine whether an affected installer version earlier than 2.5.47 was used and treat credentials recorded in its installer output as potentially exposed.
What is the additional symlink-related risk?
Because the installer did not remove the existing log file before creating it, a pre-existing symlink at /var/log/misp_install.log could redirect installer output to an arbitrary location. Review that path for unexpected symlink behavior when assessing affected installations.