CVE-2026-86408 MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events
Authenticated users can view cryptographic signing keys from protected events due to missing authorization checks in the key viewing controller.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86408?
CVE-2026-86408 is a high-severity missing authorization vulnerability in Misp-Project Misp, published on 7 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().
The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as:
* type
* key_data
* fingerprint
but did not fetch or authorize the associated parent event first.
The upstream commit explicitly states that cryptographicKeys/view could return a protected event’s signing key to any authenticated user.
The fix adds parent_id and parent_type to the lookup and then enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators.
Version affected: ≤2.5.45
Which versions are affected by CVE-2026-86408?
It affects 1 product.
Products include Misp-Project Misp.
How do I fix CVE-2026-86408?
No fix has been published for CVE-2026-86408 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-86408 being exploited?
There is no known exploitation of CVE-2026-86408 in the wild and no public exploit code.
Other vulnerabilities in Misp-Project Misp
Sources
Also known as GHSA-2qxh-mhcg-87xg.