Executive brief
MISP's interactive CLI shell is used by administrators to perform bulk actions under a specific user account. Due to a state management bug in the audit logging system, CLI writes performed after the first operation would lose track of which user performed them, causing audit records to be logged with incorrect or missing user information. This makes it difficult to trace who actually performed administrative actions, potentially masking malicious activity or complicating compliance investigations.
Technical details
The vulnerability exists in MISP's interactive CLI shell, which is designed to impersonate and audit actions under a specified MISP user ID. The root cause is that the SysLogLogable behavior stored user identity in shared instance state that could be overwritten by other models lazily attaching the same behavior. Consequently, subsequent CLI writes after the first operation would lose the intended user attribution in audit logs. Additionally, CLI-originated records lacked a CLI marker, making them indistinguishable from ordinary web actions. The attack vector requires local or administrative access to run the CLI shell. The fix involves stably attributing all CLI writes to the impersonated user and adding a CLI marker to audit records. No CVSS score was assigned to this informational-severity issue.
Affected products
- MISP MISP ≤2.5.45
Timeline
- 2026-09-14: disclosed: CVE-2026-90955 published
- 2026-09-02: patched: Fix committed to address CLI audit logging user attribution