CVE-2026-56447

The vulnerability results from lack of validation of the INI file path set by the Kafka_rdkafka_config parameter — an attacker with server administrator privileges could specify any file in the file system. MISP parsed the specified INI file and passed its options directly to the rdkafka library. A crafted configuration file could contain the plugin.library.paths option pointing to a malicious dynamic library. An attacker could place such a library in a location writable by MISP, such as an uploaded file or administrative image, and then trigger its loading and code execution with the privileges of the MISP process.

An attacker can execute arbitrary code (RCE) with the privileges of the MISP process, which can lead to system takeover, leakage of sensitive intelligence data, and compromise of the integrity of the MISP instance and systems communicating with it.

Apply the patch available in the MISP GitHub repository (commit 9600d486ccfc98388e13897fd954350cebac5fb0). The patch restricts the Kafka_rdkafka_config parameter exclusively to absolute paths of .ini files located in approved configuration directories outside the webroot and MISP upload directories. Until the update is applied, it is recommended to limit the number of accounts with server administrator privileges and monitor changes to Kafka configuration.

MISP (Misp-Project/MISP) — versions indicated in producer references; the vulnerability affects instances with enabled Kafka/rdkafka integration and server administrator access