Arbitrary Code Execution Vulnerability in MISP by Threat Actors

CVE-2026-56447

What is CVE-2026-56447?

MISP contains a vulnerability that enables an authenticated site administrator to manipulate the Kafka_rdkafka_config setting, allowing the use of arbitrary filesystem paths. This flaw arises when a crafted attacker-controlled configuration file is parsed, facilitating the execution of unsafe options through rdkafka. An attacker could exploit writable locations within MISP to host a malicious configuration file, leading to arbitrary code execution with the privileges of the MISP process. The issue has been addressed by confining the configuration to absolute .ini files located in designated, secure directories outside the webroot and MISP upload directories.

References