Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity.
\nHowever, User->setupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage.
Version affected: ≤2.5.45
The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.
"}],"value":"The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts."}],"title":"MISP: Authentication failure logging suppressed during Redis unavailability","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"review","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version range is inferred from the tag_version_boundary metadata (v2.5.46 with 189 commits after the fix), suggesting the fix landed before the v2.5.46 release; exact affected version boundaries are not explicitly stated in the patch.","The CVSS availability impact (VA:L) reflects the loss of the security-logging function rather than a denial of service against the MISP application itself.","The patch does not indicate whether the Redis throttle was the sole mechanism for auth-failure logging or whether a fallback file-based logger existed; the analysis assumes the Redis-gated path was the primary logging path for auth failures.","The commit date (2 Sep 2026) is taken at face value from the patch metadata."],"commit":"a39b25d2f141dde954a2f00feed5c6eb9e3989b5","confidence":"medium","credits":[{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5 (1M context)"}],"cvssRationale":"The vulnerability is reachable over the network (AV:N) because MISP is a web application. Attack complexity is High (AC:H) because exploitation requires the Redis instance to be specifically unavailable at the time authentication failures occur; it is not a simple request. No attack target is required (AT:N). No privileges are needed (PR:N) because the suppressed logs pertain to unauthenticated authentication-failure events. No user interaction is required (UI:N). There is no direct confidentiality or integrity impact on the MISP data store (VC:N, VI:N). The availability impact is Low (VA:L) because the security-logging/audit function is unavailable during the Redis outage, impairing detection and forensic capabilities, but the core MISP service remains operational. No cross-scope impacts (SC:N, SI:N, SA:N).","draft":false,"fixSummary":"The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.","generatedAt":"2026-09-15T09:34:28.852379Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":4,"confidence":"medium","model":"qwen3.8:27b","score":6}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"ab1b5a5a68cf32cfb514f541d5db607932836ebf557634a44adfa822631afe9c","patchSummary":"In app/Controller/AppController.php, the _shouldLog() method was restructured: a new early-return guard \"if (!$redis) { return true; }\" was inserted immediately after the setupRedis() call, so that an unavailable Redis connection causes all auth-failure events to be logged. The subsequent throttle check was simplified to \"if (!$redis->exists(...))\" since the null case is already handled. Additionally, a block of commented-out Redis throttle code in the afterFilter() method (lines referencing misp:auth_fail_throttling) was removed as dead code.","patchTruncated":false,"patches":[{"commit":"a39b25d2f141dde954a2f00feed5c6eb9e3989b5","patchSha256":"ab1b5a5a68cf32cfb514f541d5db607932836ebf557634a44adfa822631afe9c","source":"https://github.com/MISP/MISP/commit/a39b25d2f.patch","sourceUrl":"https://github.com/MISP/MISP/commit/a39b25d2f.patch","subject":"fix: [logging] Log auth failures when the throttle cannot"}],"source":"https://github.com/MISP/MISP/commit/a39b25d2f.patch","subject":"fix: [logging] Log auth failures when the throttle cannot","tagVersionBoundary":{"commits_after_fix":189,"repository":"https://github.com/MISP/MISP","tag":"v2.5.46","version":"2.5.46","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-778","rationale":"The system fails to record security-relevant events (authentication failures) when a supporting dependency (Redis) is unavailable. The logging path silently drops all audit entries under a specific operational condition, which is a textbook case of insufficient logging of security events."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20172"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-92002","datePublished":"2026-09-15T11:24:21.354Z","dateReserved":"2026-09-15T11:24:19.778Z","dateUpdated":"2026-09-15T12:09:48.540Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-15 12:17:55","lastModifiedDate":"2026-09-15 12:17:55","problem_types":["CWE-778","CWE-778 CWE-778 Insufficient Logging"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-15T12:00:12.607042Z","id":"CVE-2026-92002","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"92002","Ordinal":"1","Title":"MISP: Authentication failure logging suppressed during Redis una","CVE":"CVE-2026-92002","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"92002","Ordinal":"1","NoteData":"Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity.\n\n\nHowever, User->setupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage.\n\nVersion affected: ≤2.5.45","Type":"Description","Title":"MISP: Authentication failure logging suppressed during Redis una"}]}}}