CVE-2026-92003 MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion
Attackers can exhaust resources by triggering unthrottled authentication failure logs in MISP, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92003?
CVE-2026-92003 is a medium-severity denial of service vulnerability in MISP, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.
Two API authentication failure branches wrote directly to the Log model:
- API requests with no authentication key; - requests supplying an API key with an incorrect length
Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.
Version affected: ≤2.5.45
Which versions are affected by CVE-2026-92003?
How do I fix CVE-2026-92003?
No fix has been published for CVE-2026-92003 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-92003 being exploited?
There is no known exploitation of CVE-2026-92003 in the wild and no public exploit code.
Sources
Also known as GHSA-rr6q-fmv4-p23m.