Vulnerability · Published Sep 15, 2026 · Assigned by CIRCL

CVE-2026-92003MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion

Medium 6.9

In plain English

A medium-severity resource allocation without limits in MISP from MISP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.6%top 52.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Version affected: ≤2.5.45

Affected products (as reported)

Vendor	Product	Versions
MISP	MISP	0 – before 2.5.46

Weakness: CWE-770, CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

Security patch patch