Executive brief
MISP, an open-source threat intelligence platform, contains a vulnerability that allows an administrative user to execute malicious code on the server. By pointing a configuration setting to a specially crafted file uploaded to the system, an attacker can take full control of the MISP process. This could lead to the theft of sensitive threat data, service disruption, or further lateral movement within the corporate network.
Technical details
A remote code execution (RCE) vulnerability exists in MISP due to improper validation of the 'Kafka_rdkafka_config' setting. An authenticated site administrator can set this parameter to an arbitrary filesystem path pointing to a malicious INI file. When MISP parses this file and passes options to the rdkafka library, an attacker can use the 'plugin.library.paths' directive to load a malicious external library. The attack requires the ability to place a file on the filesystem, which can be achieved via MISP's own upload or administrative image features. The vulnerability is addressed by restricting configuration files to approved directories outside of the webroot and upload paths.
Affected products
- MISP MISP <= 2.5.41
Timeline
- 2026-06-22: disclosed
- 2026-06-22: advisory