MISP CVE-2026-85216

MISP must be deployed with the LdapAuth or LinOTPAuth plugin (not default password auth). For the LDAP path: the attacker must know a valid directory user's email address, and the backing LDAP/AD server must be configured to accept unauthenticated binds (valid DN + empty password returning success). For the LinOTP/local path: mixed authentication must be enabled so an empty password is checked against a local MISP hash, or a target account must be an LDAP-provisioned MISP account carrying an empty-password hash that is no longer resolved through LDAP. The CVSS AT:P flag encodes these configuration prerequisites; they are the main factors limiting real-world exploitation despite the network-facing, unauthenticated, no-user-interaction vector.

The CVSS 4.0 base score is 9.5 (critical) with AV:N/AC:L/PR:N/UI:N but crucially AT:P - an attack requirement flag reflecting that exploitation is not universal: the LDAP path needs a directory configured to accept unauthenticated binds, and the LinOTP/local paths need mixed-authentication enabled or an LDAP-provisioned account that has fallen out of LDAP resolution. SSVC aligns with a serious-but-not-urgent posture: Exploitation 'none' (no observed activity), Automatable 'no' (attacker must first identify a valid user email and hit a vulnerable config), but Technical Impact 'total'. There is no CISA KEV listing and no public PoC, so this is a real priority for any MISP operator using LDAP or LinOTP auth rather than an actively-exploited emergency; an operator running MISP as a shared CTI hub should nonetheless treat privileged-account impersonation as high-urgency and patch promptly. The vendor's subsequent-system impact ratings (SC:H/SI:H/SA:H) appear overstated - impersonating a user does not clearly cross a security boundary into a separate system - which inflates the score somewhat. Note the practical gate: default MISP deployments do not use LDAP/LinOTP at all, so most installs are unaffected.

An attacker enumerates or guesses a valid directory user's email (e.g. a known analyst's corporate address) and submits it to the MISP login form with a blank password. Against a MISP instance using LDAP auth backed by a directory that accepts unauthenticated binds, ldap_bind() returns success and MISP logs the attacker in as that user; if the account is an org admin the attacker reads, alters, or deletes shared threat intelligence. No public PoC is available, but the attack is low-complexity once a valid email and vulnerable configuration are known.