# CVE-2026-92003: MISP authentication-failure logging bypass

Source: https://junglewise.ai/threats/cve-2026-92003-misp-authentication-failure-logging-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92003 · Severity: info · Published 2026-09-15

MISP, an open-source threat intelligence sharing platform, contains a vulnerability in its API authentication logging that fails to apply rate-limiting consistently. Two specific authentication error conditions bypass the existing hourly throttle mechanism, allowing attackers to generate excessive log entries and potentially fill up disk space or degrade system performance through log flooding.

Technologies: [Misp](https://junglewise.ai/threats/technologies/misp). Vendors: [Misp](https://junglewise.ai/threats/vendors/misp).

## Quick answers

**Is CVE-2026-92003 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92003 being exploited in the wild.

**How severe is CVE-2026-92003?** Informational severity, published 15 September 2026.

**Which products and versions are affected?** Misp ≤2.5.45.

**Is there a fix for CVE-2026-92003?** A patch was published on 2026-09-15: Fix applied in commit 2bf8874 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92003 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92003?** Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a logging bypass (CWE-770: Allocation of Resources Without Limits) in MISP's API authentication failure handling. Two code paths—handling requests with no authentication key and requests with an incorrectly-length API key—directly write to the Log model without invoking the _shouldLog() throttle function that is applied to other authentication failures. This allows an unauthenticated attacker on the network to repeatedly trigger these conditions without rate-limiting, creating unlimited auth_fail log entries. The fix applies the existing hourly per-key throttle to both bypass paths. No evidence of exploitation in the wild has been reported; severity was classified as informational.

## Affected products

- MISP MISP ≤2.5.45

## Timeline

- 2026-09-15: disclosed
- 2026-09-15: patched: Fix applied in commit 2bf8874

## References

- [https://github.com/MISP/MISP/commit/2bf887433](https://github.com/MISP/MISP/commit/2bf887433)

## Related threats

- [MISP CSS injection in remote event preview](https://junglewise.ai/threats/cve-2026-112183-misp-contains-a-css-injection-vulnerability-in-the-remote-event)
- [MISP access control flaw in proposal visibility logic](https://junglewise.ai/threats/cve-2026-112178-misp-contains-an-access-control-flaw-in-the-proposal-shadow)
- [MISP authorization flaw in correlation handling](https://junglewise.ai/threats/cve-2026-104912-misp-contains-an-authorization-flaw-in-its-correlation-handling)
- [MISP improper input validation in decaying model import](https://junglewise.ai/threats/cve-2026-104908-misp-contains-an-improper-input-validation-vulnerability-in-the)
- [MISP reflected XSS in taxonomy tag confirmation forms](https://junglewise.ai/threats/cve-2026-103662-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability)