CVE-2026-92002 Details
Description
Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User->setupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage. Version affected: ≤2.5.45
A vulnerability exists in MISP versions through 2.5.45, where the application relies on Redis to manage and throttle authentication failure logs. When Redis is unavailable, the logging mechanism fails to record these authentication failures, effectively muting this critical audit trail. This issue arises because the function responsible for logging authentication failures only activates when a Redis connection is established and no throttle key is present. As a result, during a Redis outage, the application misses logging failed authentication attempts, which is a crucial oversight for administrators monitoring authentication activities.
Users can upgrade to MISP version 2.5.47, where this issue has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/a39b25d2f | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-778 | Insufficient Logging | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP | <= 2.5.45 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | New CVE Received | CIRCL |
| Sep 15, 2026 | CVE Modified | CISA-ADP |