CVE-2026-90895: MISP CLI Exposes Auth Creds, Bypasses ACLs

CVE-2026-90895, confirmed on NVD. CVSS: not yet assigned. Affected: MISP through 2.5.45.

MISP’s interactive CLI shell implements access control independently from the web application. Six authorization gaps result. Two affect credentials to systems outside MISP.

Feed.headers stores HTTP authorization credentials for configured external feeds. CLI output in affected versions returns these unmasked. Server synchronization authkeys are also unredacted in CLI detail output. Both represent live credentials to connected systems.

The other four gaps, per the NVD record:

• Feed listings via CLI do not enforce lookup_visible restrictions; non-host-organisation users can enumerate feeds restricted to the host org
• Feed detail access skips the host-org/site-admin gate enforced by FeedsController::view()
• Sharing group detail access does not consistently invoke SharingGroup::checkIfAuthorised()
• The use command can establish context for a record without confirming the caller has view rights on that record

The patch (commit cd9f548ed) corrects all six cases. The same commit neutralizes terminal control sequences found in database-backed strings, a separate hardening fix confirmed in the same change.

Affected: MISP through and including 2.5.45. Fix: update to MISP 2.5.46 or later.

Status: patched. No CISA KEV listing as of this writing. In-the-wild exploitation: unconfirmed.

A similar credential-in-output issue surfaced in BioStar 2 last week: Active Directory bind credentials exposed via API responses. Different product, same class of oversight in a security tool.

Full CVE record: CVE-2026-90895.