CVE-2026-86408 MISP CVE debrief

Who should care

Defenders and administrators of MISP systems should assess exposure and prioritize verification and remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify MISP versions and assess exposure to this vulnerability.

Why it matters

CVE-2026-86408 allows sensitive cryptographic keys to be accessed without proper authorization in MISP systems, requiring defenders to verify versions and assess exposure.

• Potential unauthorized access to sensitive cryptographic keys
• Need to verify MISP versions and assess exposure
• Possible impact on event authorization and access control

Technical summary

Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The fix adds parent_id and parent_type to the lookup and then enforces authorization through the associated event. This vulnerability allows sensitive cryptographic keys to be accessed without proper authorization in MISP systems, requiring defenders to verify versions and assess exposure. The upstream commit explicitly states that cryptographicKeys/view could return a protected event’s signing key to any authenticated user.

Defensive priority

Defenders should prioritize verifying MISP versions and assessing exposure, as the vulnerability allows sensitive cryptographic keys to be accessed without proper authorization.

Recommended defensive actions

• Verify MISP versions and assess exposure
• Restrict access to sensitive cryptographic keys
• Implement additional authorization checks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence is limited to the official CVE Program record and NIST NVD detail page. The upstream commit explicitly states that cryptographicKeys/view could return a protected event’s signing key to any authenticated user. Version affected: ≤2.5.45. Defenders should verify MISP versions and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.