# CVE-2026-92002: MISP Redis unavailability silences authentication failure logging

Source: https://junglewise.ai/threats/cve-2026-92002-misp-redis-unavailability-silences-authentication-failure-logging  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92002 · Severity: info · Published 2026-09-15

MISP is a threat intelligence platform that tracks security events, including failed authentication attempts. When Redis (an external cache service) becomes unavailable, the authentication-failure logging stops entirely, meaning security incidents go unrecorded and undetected during the outage. This reduces the ability to identify and respond to attack attempts.

Technologies: [Misp](https://junglewise.ai/threats/technologies/misp). Vendors: [Misp](https://junglewise.ai/threats/vendors/misp).

## Quick answers

**Is CVE-2026-92002 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92002 being exploited in the wild.

**How severe is CVE-2026-92002?** Informational severity, published 15 September 2026.

**Which products and versions are affected?** Misp ≤2.5.45.

**Is there a fix for CVE-2026-92002?** A patch was published on 2026-09-15: Fix available on GitHub commit a39b25d2f Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92002 attacked?** It is attacked from the adjacent network, in a web application.

**Am I affected by CVE-2026-92002?** Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

MISP uses Redis to throttle duplicate authentication-failure log entries. The vulnerable _shouldLog() function has a fail-closed flaw: it returns false both when throttling is active and when Redis cannot be reached. When User->setupRedis() fails to connect to Redis, the logging mechanism incorrectly rejects all authentication-failure events, silencing security logs for the duration of the Redis outage. The root cause is improper error handling that conflates throttling logic with connection failure. This is a logic error in the logging flow that affects all MISP versions up to 2.5.45. The fix, available on GitHub, corrects _shouldLog() to distinguish between "Redis unavailable" and "throttle key present" conditions.

## Affected products

- MISP MISP ≤2.5.45

## Timeline

- 2026-09-15: disclosed
- 2026-09-15: patched: Fix available on GitHub commit a39b25d2f

## References

- [https://github.com/MISP/MISP/commit/a39b25d2f](https://github.com/MISP/MISP/commit/a39b25d2f)

## Related threats

- [MISP CSS injection in remote event preview](https://junglewise.ai/threats/cve-2026-112183-misp-contains-a-css-injection-vulnerability-in-the-remote-event)
- [MISP access control flaw in proposal visibility logic](https://junglewise.ai/threats/cve-2026-112178-misp-contains-an-access-control-flaw-in-the-proposal-shadow)
- [MISP authorization flaw in correlation handling](https://junglewise.ai/threats/cve-2026-104912-misp-contains-an-authorization-flaw-in-its-correlation-handling)
- [MISP improper input validation in decaying model import](https://junglewise.ai/threats/cve-2026-104908-misp-contains-an-improper-input-validation-vulnerability-in-the)
- [MISP reflected XSS in taxonomy tag confirmation forms](https://junglewise.ai/threats/cve-2026-103662-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability)