Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.
\nTwo API authentication failure branches wrote directly to the Log model:
Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.
The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client's source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read('CurrentRequestAuthFailKeys')) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator's log_each_individual_auth_fail setting.
" } ], "value": "The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client's source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read('CurrentRequestAuthFailKeys')) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator's log_each_individual_auth_fail setting." } ], "title": "MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion", "x_gcve": [ { "extensions": { "bcp-05-x-01": { "ai_annotations": [ { "ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [ { "gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama" } ], "review_status": "review", "scope": "record", "tags": [ "ai-computer-assisted:llm-generated", "ai-computer-assisted:classification" ] } ] }, "bcp-05-x-02": { "x_patch2vuln": { "assumptions": [ "The tag_version_boundary (v2.5.46, 188 commits after fix) is used as an approximate upper bound for affected versions; the exact fixed release tag is not stated in the patch metadata.", "The log entries are written to a relational database (MySQL/PostgreSQL) via MISP's Log model, based on the createLogEntry() call pattern; the specific backend is not confirmed in the patch.", "The Redis instance used for throttling is assumed to be co-located with the MISP application; a Redis outage degrades to logging everything (fail-open), which is a design choice documented in the patch comments.", "CVSS VA:H assumes that sustained unthrottled log writes can exhaust storage or I/O capacity sufficient to degrade or halt the MISP service; actual impact depends on deployment sizing and disk capacity." ], "commit": "2bf8874336518d8c5ef6a42e51e78900ec242630", "confidence": "medium", "credits": [ { "lang": "en", "type": "remediation developer", "value": "iglocska" }, { "lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)" } ], "cvssRationale": "The vulnerable paths are reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N). The attack complexity is low (AC:L): an attacker simply sends repeated HTTP requests to the MISP API without an API key or with a key of the wrong length. No attack target is required (AT:N). There is no impact on confidentiality (VC:N, SC:N) or integrity (VI:N, SI:N). The availability impact is high (VA:H) because unbounded log writes can exhaust database storage, degrade query performance, and ultimately make the MISP instance unavailable. No secondary availability impact (SA:N) is evident from the patch.", "draft": false, "fixSummary": "The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client's source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read('CurrentRequestAuthFailKeys')) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator's log_each_individual_auth_fail setting.", "generatedAt": "2026-09-15T11:37:41.625192Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": { "rankings": [ { "agreementScore": 9, "assumptionCount": 4, "confidence": "medium", "model": "qwen3.8:27b", "score": 6 } ], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required." }, "patchSha256": "db6f78e69079c91d4ba1dac46c4ed5b8ff1ca617c00cd6733bff926c0925a2e3", "patchSummary": "In app/Controller/AppController.php: (1) The 'no authkey' branch in beforeFilter() now calls _shouldLog('noauthkey:' . $this->User->_remoteIp()) before writing the log entry. (2) The 'incorrect length' branch in __loginByAuthKey() now calls _shouldLog('badauthkeylength:' . $this->User->_remoteIp()) before writing the log entry. (3) _shouldLog() is refactored to first check a per-request memo array (Configure 'CurrentRequestAuthFailKeys') to suppress duplicate logging across the double beforeFilter() invocation, then evaluate the log_each_individual_auth_fail setting, then fall through to the Redis EXISTS/SETEX 3600-second throttle, and finally record the key in the memo. The Redis-unavailable fallback (log everything) is preserved.", "patchTruncated": false, "patches": [ { "commit": "2bf8874336518d8c5ef6a42e51e78900ec242630", "patchSha256": "db6f78e69079c91d4ba1dac46c4ed5b8ff1ca617c00cd6733bff926c0925a2e3", "source": "https://github.com/MISP/MISP/commit/2bf887433.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/2bf887433.patch", "subject": "fix: [logging] Throttle the two unguarded auth_fail writes" } ], "source": "https://github.com/MISP/MISP/commit/2bf887433.patch", "subject": "fix: [logging] Throttle the two unguarded auth_fail writes", "tagVersionBoundary": { "commits_after_fix": 188, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.46", "version": "2.5.46", "version_type": "semver" }, "weaknessRationale": [ { "cweId": "CWE-770", "rationale": "Two authentication-failure log write paths lacked any rate-limiting or throttling mechanism, allowing an unauthenticated remote attacker to generate an unbounded number of database log entries and exhaust storage or I/O resources. The fix adds the missing hourly per-key throttle." }, { "cweId": "CWE-400", "rationale": "The unthrottled log writes constitute uncontrolled consumption of database write capacity and disk storage, enabling a denial-of-service condition. CWE-770 is the more specific primary weakness; CWE-400 captures the broader resource-exhaustion impact." } ] } } }, "recordType": "advisory", "vulnId": "GCVE-1-2026-20158" } ] }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-09-15T12:31:54.934768Z", "id": "CVE-2026-92003", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T12:32:06.515Z" } } ] } }