MISP CVE-2026-56447

Requires an authenticated MISP site administrator account (the Server Settings UI/API is restricted to site_admin role) on a MISP instance where the Kafka_rdkafka_config setting is writable. The attacker must also be able to stage two attacker-controlled files on the MISP host's filesystem - typically via MISP's own upload features (event attachments, organisation logo image, or any other MISP-writable directory) - and must trigger a code path that initialises the rdkafka producer, so a deployment with Kafka publishing wired up (or reachable through the admin UI) makes exploitation most reliable. Limiting factors: no anonymous or low-privileged user can reach the setting, no user interaction by another victim is needed, and the vulnerable behaviour exists in default builds regardless of whether Kafka is configured because the INI parser runs as soon as the setting is consumed.

CVSS 4.0 of 9.3 is driven by AV:N/AC:L with high confidentiality, integrity and subsequent-system impact, but PR:H is the key moderator - only a MISP site administrator can change server settings, so this is a privilege-escalation/persistence primitive rather than a perimeter-breaching RCE. There is no EPSS, KEV, or public PoC signal in the input, and the issue was reported coordinated by CIRCL (MISP's own maintainer), so real-world exploitation is currently best assessed as low-volume but high-impact when triggered. The most realistic threat models are a rogue or compromised admin account (credential theft, session hijack, insider) converting admin access into OS-level code execution and lateral movement off the MISP host, which matters because MISP instances typically hold sensitive cross-organisation threat intel and API keys. Note one caveat: the diff shown in the input patches testLogPath() (log file path hardening), not Kafka_rdkafka_config directly, so the linked commit appears to be part of a broader hardening series - operators should confirm the Kafka-specific validator is present in the version they install.

A MISP site administrator (legitimate insider, or attacker who has phished/hijacked an admin session or API key) uploads a malicious shared library disguised as an attachment or organisation logo, then uploads a small INI file containing plugin.library.paths=/var/www/MISP/app/files/<id>/payload.so. They navigate to Administration → Server Settings, set Kafka_rdkafka_config to the INI file path, and trigger any Kafka-publishing action; rdkafka dlopen()s the payload and the attacker gains code execution as the www-data/apache user. No public exploit is identified at time of analysis.