MISP CLI Shell Authorization Bypass and Credential Exposure
MISP through 2.5.45 has CLI access controls separate from the web app, exposing HTTP feed credentials and server sync authkeys to unauthorized CLI users. Fix available in 2.5.46.
- Vendor
- MISP Project
- Product
- MISP
- CVSS
- N/A
- EPSS (exploit probability)
- 0.1%
- Status
- patched
- Published
Is CVE-2026-90895 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-90895 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-05 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.1% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-90895 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-90895 is an authorization inconsistency in MISP’s interactive CLI shell. The CLI implements access control independently from the web application, creating gaps not present in the normal web interface.
Six specific inconsistencies are documented in the NVD record: feed listing visibility bypass for non-host-organisation users; feed detail access skipping host-org/site-admin gating; Feed.headers (which stores HTTP authorization credentials) returned unmasked; server sync authkeys unredacted in CLI detail output; sharing group access inconsistency; and the use command establishing record context without view-authorization confirmation.
CVSS score: not yet assigned by NVD. Severity classification is pending formal scoring.
Affected: MISP through and including 2.5.45. Fix: update to MISP 2.5.46 or later. Patch: GitHub commit cd9f548ed.
No CISA KEV listing. In-the-wild exploitation: unconfirmed as of publication.
