Executive brief
MISP, an open-source threat intelligence sharing platform, contains a vulnerability in its API authentication logging that fails to apply rate-limiting consistently. Two specific authentication error conditions bypass the existing hourly throttle mechanism, allowing attackers to generate excessive log entries and potentially fill up disk space or degrade system performance through log flooding.
Technical details
The vulnerability is a logging bypass (CWE-770: Allocation of Resources Without Limits) in MISP's API authentication failure handling. Two code paths—handling requests with no authentication key and requests with an incorrectly-length API key—directly write to the Log model without invoking the _shouldLog() throttle function that is applied to other authentication failures. This allows an unauthenticated attacker on the network to repeatedly trigger these conditions without rate-limiting, creating unlimited auth_fail log entries. The fix applies the existing hourly per-key throttle to both bypass paths. No evidence of exploitation in the wild has been reported; severity was classified as informational.
Affected products
- MISP MISP ≤2.5.45
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fix applied in commit 2bf8874