MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials

published 2026-09-22 47 d ago modified 2026-09-22 47 d ago also EUVD-2026-84379

cvss: 6.9; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits: 0; none known

The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked.

Any local unprivileged user on the system could read the log file or the FIFO to obtain these credentials.

Additionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location.

Version affected: <2.5.47

Patch / fix

fixed in 1 links 1

MISP MISP 2.5.47

github.com/MISP/MISP@d5d72ab commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 47 d ago (2026-09-22)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	6.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

MISP MISP

Classification

Weakness

CWE-732 Incorrect Permission Assignment for Critical Resource
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

github.com /MISP/MISP/commit/d5d72ab38
patch

Sources

CVE List CVE-2026-95667
NVD CVE-2026-95667

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary