CVE-2026-92003 PUBLISHED

MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion

Assigner: CIRCL
Reserved: 15.09.2026 Published: 15.09.2026 Updated: 15.09.2026

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.

Two API authentication failure branches wrote directly to the Log model:

- API requests with no authentication key;  - requests supplying an API key with an incorrect length

Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.

Version affected: ≤2.5.45

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor MISP
Product MISP
Versions
  • affected from 0 to 2.5.46 (excl.)

Solutions

The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client's source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read('CurrentRequestAuthFailKeys')) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator's log_each_individual_auth_fail setting.

Credits

  • iglocska remediation developer
  • Claude Opus 5 (1M context) remediation developer

References

Problem Types

  • CWE-770 Allocation of Resources Without Limits or Throttling CWE
  • CWE-400 Uncontrolled Resource Consumption CWE

Impacts

  • CAPEC-125 Flooding