Cryptographic Key Access Vulnerability in MISP by MISP Project
CVE-2026-86408

7.1HIGH

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
7 September 2026

What is CVE-2026-86408?

A security issue exists in MISP versions up to 2.5.45, where the CryptographicKeysController does not enforce visibility settings for parent events. This oversight allows authenticated users to query sensitive cryptographic keys without proper authorization, potentially exposing signing keys linked to protected events. A patch has been implemented to enhance security by requiring checks against the parent event, restricting key access to site administrators if the parent is not classified as an Event.

Affected Version(s)

MISP 0 <= 2.5.45

References

https://github.com/MISP/MISP/commit/2edde619b
patch

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Scottish Government - National Cyber Team
iglocska
Claude Opus 5 (1M context)
.