MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
Impact
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.
Source excerpt · CIRCLWhat to do
The settings lookup function now validates that the resolved node is a leaf setting (has a 'level' property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
MISP · CIRCL
MISP
1 range
MISP · CIRCL
MISP
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 2.5.48
semver versions
Other versions: unknown
Product identifiers (CPE)
cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*Original source description
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.
The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.
A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.
The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.
Affected versions: <2.5.48.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-112188View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.