MISP Server Configuration Exposure Vulnerability by MISP

CVE-2026-112188

What is CVE-2026-112188?

MISP contains a vulnerability within its server settings lookup mechanism, allowing authenticated users to access sensitive configuration data that should remain redacted. The issue arises when a user inputs a branch name, such as 'Security' or 'Plugin', instead of a specific setting. This input bypasses redaction checks, enabling the retrieval of complete sub-trees containing critical information, including security salts and API keys. Similarly, an editing endpoint also discloses full configuration details when branch names are used. Consequently, this vulnerability can lead to unauthorized exposure of sensitive server configuration secrets to users who can access the settings endpoints.

References