Is CVE-2026-112192 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112192 being exploited in the wild.

How severe is CVE-2026-112192?

Informational severity, published 19 October 2026.

Which products and versions are affected?

MISP Project MISP before 2.5.48.

Is there a fix for CVE-2026-112192?

Yes: fixed in 2.5.48. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112192 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112192?

Check whether you run MISP Project MISP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112192: MISP module plugin settings flags not preserved

CVE-2026-112192 · Severity: info · Published 2026-10-19

MISP is a threat intelligence platform that stores and manages security indicators. When MISP rebuilds module configuration settings for API access, it fails to preserve security flags (redacted and cli_only) that module authors set, allowing authenticated users to read sensitive credentials like API keys and modify settings restricted to command-line-only access.

Technologies: MISP Project MISP. Vendors: MISP Project.

Quick answers

Is CVE-2026-112192 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112192 being exploited in the wild.
How severe is CVE-2026-112192?: Informational severity, published 19 October 2026.
Which products and versions are affected?: MISP Project MISP before 2.5.48.
Is there a fix for CVE-2026-112192?: Yes: fixed in 2.5.48. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112192 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112192?: Check whether you run MISP Project MISP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.5.48

Technical details

The vulnerability exists in the readModuleSettings() function in Server.php, which rebuilds module-supplied settings for API consumption but drops the redacted and cli_only flags declared in the module's configuration metadata. An authenticated user with access to server settings can exploit this to read redacted sensitive values via servers/getSetting and servers/serverSettingsEdit endpoints, or bypass CLI-only restrictions to modify settings over the API. The fix preserves these flags when reconstructing settings.

Affected products

MISP Project MISP before 2.5.48

Timeline

2026-10-19: disclosed

References

https://github.com/MISP/MISP/commit/6c02f0f5c

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.