CVE-2026-95667 Details
Description
The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked. Any local unprivileged user on the system could read the log file or the FIFO to obtain these credentials. Additionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location. Version affected: <2.5.47
A vulnerability exists in the MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4. The scripts create a log file and a named pipe to capture installer output, including sensitive information such as the admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created with world-readable permissions, and the FIFO also inherited world-readable permissions before being unlinked. This allowed any local unprivileged user to read the log file or FIFO and access these credentials. Additionally, the log file was not removed before creation, leaving open the possibility of redirecting the output to an arbitrary location via a pre-existing symlink.
Users can update to MISP version 2.5.47 or later, where this vulnerability has been addressed. Instructions for updating MISP can be found in the MISP documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/d5d72ab38 | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CIRCL |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP | < 2.5.47 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | CIRCL |