MISP EUVD-2026-84379

Requires a local unprivileged account on a host where a MISP administrator runs (or has recently run) one of the affected OS installer scripts (INSTALL.debian12.sh, INSTALL.debian13.sh, INSTALL.ubuntu2404.sh, or xINSTALL.rhel94.sh) on Debian 12/13, Ubuntu 24.04, or RHEL 9.4. The credential-bearing /var/log/misp_install.log is world-readable (0644) and persists after install, giving a durable read window; the /var/log/misp_install.log.pipe FIFO is only readable during a short race before it is unlinked. The alternative symlink-redirect path additionally requires the attacker to pre-position a symlink in /var/log before root launches the installer. Limiting factors: local access only (no network exploitation), single-user/dedicated MISP appliances have no unprivileged local users to abuse, and the richest exposure is bounded to the installation time window.

This is a locally-exploitable information-disclosure/incorrect-permissions flaw (CWE-732) in MISP's OS installer scripts, not in the running MISP application itself. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) yields 6.9 and correctly emphasizes local attack vector with high confidentiality impact and no integrity/availability impact - consistent with a world-readable log/FIFO leaking the freshly generated admin, database, GPG, and supervisor secrets. No EPSS score, KEV entry, or public POC was provided, so exploitation status is 'no public exploit identified at time of analysis'; the risk is real but narrowly scoped. Two factors sharply limit real-world priority: (1) the sensitive log only contains all credentials during and shortly after installation, and the FIFO is unlinked quickly, so an attacker needs a local unprivileged account on the box AT install time (or before the world-readable log is rotated/removed); (2) it requires an already-provisioned MISP host with a low-privileged multi-user population, which is uncommon for a dedicated appliance. Note a metric nuance: the vendor rates PR:N, but reading the file inherently requires an existing local login, which most 3.1 practitioners would score PR:L - verify intended privilege assumption with CIRCL. The secondary symlink-redirect issue (pre-existing symlink in /var/log redirecting the tee write) adds an integrity/arbitrary-write dimension the VI:N rating omits, but it needs an attacker to pre-position a symlink before root runs the installer.

A low-privileged user already present on a host is present while an administrator runs the MISP installer; they read the world-readable /var/log/misp_install.log (mode 0644) or race the world-readable FIFO before it is unlinked, harvesting the generated admin, MySQL/database, GPG passphrase, and supervisor passwords in cleartext. Alternatively they pre-plant a symlink at /var/log/misp_install.log so the installer's tee write is redirected to an arbitrary root-owned path. No public exploit code was identified; exploitation is straightforward file reading requiring only local access.