Is CVE-2026-104908 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104908 being exploited in the wild.

How severe is CVE-2026-104908?

Informational severity, published 2 October 2026.

Is there a fix for CVE-2026-104908?

Yes: fixed in 2.5.48. Until then: Restrict decaying model import permissions (perm_decaying) to trusted administrators only until the upgrade is applied, as the vulnerability requires authentication with this specific capability. [{"kind":"disclosed","at":"2026-10-02"},{"kind":"patched","at":"2026-09-25","note":"Commit 70e319e4b9 implements allow-list approach for model construction"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104908 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104908?

Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104908: MISP improper input validation in decaying model import

CVE-2026-104908 · Severity: info · Published 2026-10-02

MISP is an open-source threat intelligence platform used by organizations to share and analyze malware, security incidents, and indicators of compromise. An authenticated attacker with decaying model permissions can manipulate the import function to overwrite other organizations' models, reassign model ownership, or create default models that affect scoring for other users.

Technologies: Misp. Vendors: Misp.

Quick answers

Is CVE-2026-104908 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104908 being exploited in the wild.
How severe is CVE-2026-104908?: Informational severity, published 2 October 2026.
Which products and versions are affected?: Misp before 2.5.48.
Is there a fix for CVE-2026-104908?: Yes: fixed in 2.5.48. Until then: Restrict decaying model import permissions (perm_decaying) to trusted administrators only until the upgrade is applied, as the vulnerability requires authentication with this specific capability.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-02"},{"kind":"patched","at":"2026-09-25","note":"Commit 70e319e4b9 implements allow-list approach for model construction"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104908 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104908?: Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.5.48

Restrict decaying model import permissions (perm_decaying) to trusted administrators only until the upgrade is applied, as the vulnerability requires authentication with this specific capability.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-02"},{"kind":"patched","at":"2026-09-25","note":"Commit 70e319e4b9 implements allow-list approach for model construction"}]

Technical details

The decaying model import endpoint performs insufficient input validation on nested JSON structures. An attacker with perm_decaying permission can supply a nested model key carrying its own primary key, organization identifier, and default flag, bypassing the intended guards that strip only top-level id and uuid fields. This allows overwriting existing models, modifying default flags, or reassigning organization ownership of any model in the system.

Affected products

MISP MISP before 2.5.48

References

https://github.com/MISP/MISP/commit/70e319e4b

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.