CVE-2026-112180 MISP CVE debrief

Who should care

MISP administrators and users with sufficient privileges to delete events should assess exposure and ensure proper event deletion and data retention policies are in place. This includes reviewing and updating MISP to version 2.5.49 or later, implementing additional monitoring, and restricting access to sensitive data and administrative interfaces.

Why it matters

CVE-2026-112180 is a medium-severity vulnerability in MISP's event deletion logic, allowing sensitive records to persist after event deletion. MISP administrators and users with deletion privileges should assess exposure and ensure proper event deletion and data retention policies are in place.

• Residual sensitive data persists in the database after the parent event is deleted.
• Accumulation of orphaned records over time may contribute to storage bloat.
• Orphaned records may be reachable through other application queries or administrative interfaces.

Technical summary

MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. These orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces.

Defensive priority

Medium

Recommended defensive actions

• Review and update MISP to version 2.5.49 or later to ensure proper event deletion.
• Implement additional monitoring to detect and remove orphaned records.
• Restrict access to sensitive data and administrative interfaces.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on a data integrity flaw in MISP's event deletion logic, leading to orphaned sensitive records. The affected record types include event report tags, event graph entries, proposal correlations, fuzzy ssdeep correlation chunks, and attachment scan results. Evidence is limited to CVE and source item details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.