Sensitive Data Exposure in MISP Installer for Debian and Ubuntu
CVE-2026-95667

6.9MEDIUM

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
22 September 2026

What is CVE-2026-95667?

The MISP installer scripts for Debian, Ubuntu, and RHEL create a log file that stores sensitive information such as admin and database passwords. Due to inadequate permissions settings, local unprivileged users can potentially access these credentials. Furthermore, the installer does not securely handle existing symlinks, which could lead to arbitrary data exposure if a symlink is already present in the log directory. This poses a significant risk to the integrity of sensitive data within systems running affected versions of the MISP installer.

Affected Version(s)

MISP 0 < 2.5.47

References

https://github.com/MISP/MISP/commit/d5d72ab38
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Niels Teusink of Eye Security
iglocska
Claude Opus 5 (1M context)
.