CVE-2026-85216 misp CVE debrief

Who should care

MISP administrators, security teams, and IT professionals responsible for maintaining and securing MISP installations should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

CVE-2026-85216 is a critical authentication bypass vulnerability in MISP's LDAP and LinOTP authentication components. Successful exploitation could allow a remote unauthenticated attacker to impersonate an existing MISP user, potentially gaining access to sensitive data and privileged operations. MISP administrators and security teams should assess their exposure and take necessary actions to mitigate the vulnerability.

• An attacker could gain unauthorized access to sensitive threat-intelligence data.
• An attacker could modify or delete information, alter configuration, or perform other privileged operations.
• An attacker could impersonate existing MISP users, including those with administrative privileges.
• Verification of user credentials and authentication mechanisms is necessary to prevent exploitation.

Technical summary

The custom LdapAuthenticate and LinOTPAuthenticate components in MISP did not replicate CakePHP's FormAuthenticate implementation credential validation checks, allowing empty or non-string values to reach the underlying authentication mechanisms. This could permit an attacker to bypass authentication and impersonate existing MISP users. The issue also affected the LinOTP authentication component. Invalid credential types were not rejected before being processed, and when mixed authentication was enabled, an empty password could be checked against a locally stored MISP password hash. LDAP-provisioned MISP accounts could additionally be created with an empty local password because account creation skipped normal validation, resulting in a hash corresponding to an empty password. This could permit authentication through the local fallback mechanism when such an account was no longer resolved through LDAP. Successful exploitation could allow a remote unauthenticated attacker to impersonate an existing MISP user. If the targeted account has administrative or other privileged permissions, the attacker could gain corresponding access to sensitive threat-intelligence data, modify or delete information, alter configuration, or perform other privileged operations. The patch resolves the vulnerability by requiring authentication identifiers and passwords to be valid strings, rejecting empty passwords where they are not explicitly permitted, and assigning a randomly generated local password to LDAP-provisioned accounts instead of storing a hash derived from an empty password. MISP administrators and security teams should assess their exposure and take necessary actions to mitigate the vulnerability. Verification of user credentials and authentication mechanisms is necessary to prevent exploitation. The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to the patched commit. The patch resolves the vulnerability by requiring authentication identifiers and passwords to be valid strings, rejecting empty passwords where they are not explicitly permitted, and assigning a randomly generated local password to LDAP-

Defensive priority

High

Recommended defensive actions

• Review and update MISP configurations to ensure secure authentication mechanisms are in place.
• Implement additional monitoring to detect potential authentication bypass attempts.
• Verify that all MISP users have strong, unique passwords and consider implementing multi-factor authentication.
• Apply the patch to update the LdapAuthenticate and LinOTPAuthenticate components.
• Conduct a thorough review of existing MISP user accounts and ensure that all accounts have strong, unique passwords.
• Consider implementing a Web Application Firewall (WAF) to detect and prevent common web attacks.
• Perform regular security audits and penetration testing to identify and address potential vulnerabilities.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to the patched commit. The custom LdapAuthenticate and LinOTPAuthenticate components in MISP did not replicate CakePHP's FormAuthenticate implementation credential validation checks, allowing empty or non-string values to reach the underlying authentication mechanisms. This could permit an attacker to bypass authentication and impersonate existing MISP users. MISP administrators and security teams should assess their exposure and take necessary actions to mitigate the vulnerability. Verification of user credentials and authentication mechanisms is necessary to prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.