GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1-2026-20172 (CVE-2026-92002)

Vulnerability from gna-1 – Published: 2026-09-15 11:24 – Updated: 2026-09-15 11:24
VLAI
Title
MISP: Authentication failure logging suppressed during Redis unavailability
Summary
Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User->setupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage. Version affected: ≤2.5.45
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
MISP MISP Affected: 0 , < 2.5.46 (semver)
guessed Create a notification for this product.
Credits
iglocska Claude Opus 5 (1M context)
GCVE extensions
AI involvement GCVE-BCP-05-X-01
Whole record AI-generated Review: review GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
Patch provenance GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-15 09:34
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/a39b25d2f.patch ab1b5a5a68cf…
Confidence
medium
Commit Subject Patch SHA-256
a39b25d2f141 fix: [logging] Log auth failures when the throttle cannot ab1b5a5a68cf…
Fix summary

The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.

Patch summary

In app/Controller/AppController.php, the _shouldLog() method was restructured: a new early-return guard "if (!$redis) { return true; }" was inserted immediately after the setupRedis() call, so that an unavailable Redis connection causes all auth-failure events to be logged. The subsequent throttle check was simplified to "if (!$redis->exists(...))" since the null case is already handled. Additionally, a block of commented-out Redis throttle code in the afterFilter() method (lines referencing misp:auth_fail_throttling) was removed as dead code.

CVSS rationale

The vulnerability is reachable over the network (AV:N) because MISP is a web application. Attack complexity is High (AC:H) because exploitation requires the Redis instance to be specifically unavailable at the time authentication failures occur; it is not a simple request. No attack target is required (AT:N). No privileges are needed (PR:N) because the suppressed logs pertain to unauthenticated authentication-failure events. No user interaction is required (UI:N). There is no direct confidentiality or integrity impact on the MISP data store (VC:N, VI:N). The availability impact is Low (VA:L) because the security-logging/audit function is unavailable during the Redis outage, impairing detection and forensic capabilities, but the core MISP service remains operational. No cross-scope impacts (SC:N, SI:N, SA:N).

Weakness rationale
  • CWE-778 The system fails to record security-relevant events (authentication failures) when a supporting dependency (Redis) is unavailable. The logging path silently drops all audit entries under a specific operational condition, which is a textbook case of insufficient logging of security events.
Assumptions to verify
  • The affected version range is inferred from the tag_version_boundary metadata (v2.5.46 with 189 commits after the fix), suggesting the fix landed before the v2.5.46 release; exact affected version boundaries are not explicitly stated in the patch.
  • The CVSS availability impact (VA:L) reflects the loss of the security-logging function rather than a denial of service against the MISP application itself.
  • The patch does not indicate whether the Redis throttle was the sole mechanism for auth-failure logging or whether a fallback file-based logger existed; the analysis assumes the Redis-gated path was the primary logging path for auth failures.
  • The commit date (2 Sep 2026) is taken at face value from the patch metadata.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 6 9 medium 4
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Controller/AppController.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AppController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity.\u003c/p\u003e\n\u003cp\u003eHowever, \u003ccode\u003eUser-\u0026gt;setupRedis()\u003c/code\u003e returns false when Redis cannot be reached. The vulnerable \u003ccode\u003e_shouldLog()\u003c/code\u003e logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity.\n\n\nHowever, User-\u003esetupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/a39b25d2f"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.\u003c/p\u003e"
            }
          ],
          "value": "The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts."
        }
      ],
      "title": "MISP: Authentication failure logging suppressed during Redis unavailability",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary metadata (v2.5.46 with 189 commits after the fix), suggesting the fix landed before the v2.5.46 release; exact affected version boundaries are not explicitly stated in the patch.",
                  "The CVSS availability impact (VA:L) reflects the loss of the security-logging function rather than a denial of service against the MISP application itself.",
                  "The patch does not indicate whether the Redis throttle was the sole mechanism for auth-failure logging or whether a fallback file-based logger existed; the analysis assumes the Redis-gated path was the primary logging path for auth failures.",
                  "The commit date (2 Sep 2026) is taken at face value from the patch metadata."
                ],
                "commit": "a39b25d2f141dde954a2f00feed5c6eb9e3989b5",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is reachable over the network (AV:N) because MISP is a web application. Attack complexity is High (AC:H) because exploitation requires the Redis instance to be specifically unavailable at the time authentication failures occur; it is not a simple request. No attack target is required (AT:N). No privileges are needed (PR:N) because the suppressed logs pertain to unauthenticated authentication-failure events. No user interaction is required (UI:N). There is no direct confidentiality or integrity impact on the MISP data store (VC:N, VI:N). The availability impact is Low (VA:L) because the security-logging/audit function is unavailable during the Redis outage, impairing detection and forensic capabilities, but the core MISP service remains operational. No cross-scope impacts (SC:N, SI:N, SA:N).",
                "draft": false,
                "fixSummary": "The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.",
                "generatedAt": "2026-09-15T09:34:28.852379Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "ab1b5a5a68cf32cfb514f541d5db607932836ebf557634a44adfa822631afe9c",
                "patchSummary": "In app/Controller/AppController.php, the _shouldLog() method was restructured: a new early-return guard \"if (!$redis) { return true; }\" was inserted immediately after the setupRedis() call, so that an unavailable Redis connection causes all auth-failure events to be logged. The subsequent throttle check was simplified to \"if (!$redis-\u003eexists(...))\" since the null case is already handled. Additionally, a block of commented-out Redis throttle code in the afterFilter() method (lines referencing misp:auth_fail_throttling) was removed as dead code.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "a39b25d2f141dde954a2f00feed5c6eb9e3989b5",
                    "patchSha256": "ab1b5a5a68cf32cfb514f541d5db607932836ebf557634a44adfa822631afe9c",
                    "source": "https://github.com/MISP/MISP/commit/a39b25d2f.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/a39b25d2f.patch",
                    "subject": "fix: [logging] Log auth failures when the throttle cannot"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/a39b25d2f.patch",
                "subject": "fix: [logging] Log auth failures when the throttle cannot",
                "tagVersionBoundary": {
                  "commits_after_fix": 189,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-778",
                    "rationale": "The system fails to record security-relevant events (authentication failures) when a supporting dependency (Redis) is unavailable. The logging path silently drops all audit entries under a specific operational condition, which is a textbook case of insufficient logging of security events."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20172"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-92002",
    "datePublished": "2026-09-15T11:24:14.041885Z",
    "dateReserved": "2026-09-15T11:24:19.778Z",
    "dateUpdated": "2026-09-15T11:24:19.852432Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20172"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.