The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked.
Any local unprivileged user on the system could read the log file or the FIFO to obtain these credentials.
Additionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location.
Version affected: <2.5.47
"}],"value":"The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked. \n\nAny local unprivileged user on the system could read the log file or the FIFO to obtain these credentials. \n\nAdditionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location.\n\nVersion affected: <2.5.47"}],"impacts":[{"capecId":"CAPEC-135","descriptions":[{"lang":"en","value":"CAPEC-135 Exploiting Incorrectly Configured Security Permissions"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-732","description":"CWE-732 Incorrect Permission Assignment for Critical Resource","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Path Traversal","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-22T13:11:44.277Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/d5d72ab38"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The installer scripts now explicitly create the log file with 0600 permissions using install -m 0600 and the FIFO with mkfifo -m 0600, ensuring both are root-readable/writable only from the moment of creation. The log file is also removed (rm -f) before creation to prevent a pre-existing symlink in /var/log from being used to redirect the write to an attacker-controlled path. This matches the existing 0600 treatment applied to /root/misp_settings.txt by the save_settings() function.
"}],"value":"The installer scripts now explicitly create the log file with 0600 permissions using install -m 0600 and the FIFO with mkfifo -m 0600, ensuring both are root-readable/writable only from the moment of creation. The log file is also removed (rm -f) before creation to prevent a pre-existing symlink in /var/log from being used to redirect the write to an attacker-controlled path. This matches the existing 0600 treatment applied to /root/misp_settings.txt by the save_settings() function."}],"title":"MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version range is inferred from the tag_version_boundary (v2.5.47 with 38 commits after fix); the exact first affected version is not specified in the patch metadata.","The vulnerability is transient in the sense that it only manifests during the installer execution window, but the log file persists on disk after installation and remains world-readable unless the administrator manually changes permissions or removes it.","The CVSS assumes the log file remains on disk after installation; if it is immediately removed by the installer, the exposure window is shorter but the file is still readable during the installation process.","CAPEC-135 is the closest available attack pattern; no CAPEC specifically covers 'reading a world-readable log file containing credentials,' so the general permission-misuse pattern is the best match.","The symlink attack vector (CWE-22) is a secondary concern addressed by the same patch; the primary vulnerability is the incorrect file permissions (CWE-732).","The installer is assumed to run as root (standard for system installation scripts), which is why 0600 permissions restrict access to root only."],"capecRationale":[{"capecId":"CAPEC-135","rationale":"The most direct attack pattern is a local unprivileged user simply reading the world-readable log file at /var/log/misp_install.log to harvest sensitive credentials. No complex exploitation is required beyond file read access. CAPEC-135 covers the general pattern of an attacker leveraging misconfigured file permissions to access sensitive data. The symlink variant (CWE-22) could also map to CAPEC-135 as a sub-technique of permission exploitation."}],"commit":"d5d72ab38eda4a6c343b784494a4ae9d0d94bd80","confidence":"high","credits":[{"lang":"en","type":"reporter","value":"Niels Teusink of Eye Security"},{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5 (1M context)"}],"cvssRationale":"Attack Vector is Local because the attacker must have a local account or shell access on the system where the MISP installer runs. Attack Complexity is Low because reading a world-readable file requires no special conditions. No Attack Target manipulation is needed. Privileges Required is None because the file is world-readable (0644) and any unprivileged local user can read it. No User Interaction is required. Confidentiality impact is High because the log contains the admin password, database passwords, GPG passphrase, and supervisor password, granting full compromise of the MISP deployment. Integrity and Availability impacts are None. Scope is Not Changed because the exposed credentials belong to the same MISP system. The vulnerability is transient (only during installation) but the log file persists after installation unless manually removed.","fixSummary":"The installer scripts now explicitly create the log file with 0600 permissions using install -m 0600 and the FIFO with mkfifo -m 0600, ensuring both are root-readable/writable only from the moment of creation. The log file is also removed (rm -f) before creation to prevent a pre-existing symlink in /var/log from being used to redirect the write to an attacker-controlled path. This matches the existing 0600 treatment applied to /root/misp_settings.txt by the save_settings() function.","generatedAt":"2026-09-22T13:03:07.672539Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":6,"confidence":"high","model":"qwen3.8:27b","score":5}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"e0af51eb247c4727485796d1bd4fcc2c30cb34c2a733043a3371df7e94cb81f0","patchSummary":"In all four installer scripts (INSTALL.debian12.sh, INSTALL.debian13.sh, INSTALL.ubuntu2404.sh, xINSTALL.rhel94.sh), the single line mkfifo ${logfile}.pipe is replaced with three lines: rm -f \"$logfile\" to remove any pre-existing file or symlink; install -m 0600 /dev/null \"$logfile\" to create the log file with root-only permissions; and mkfifo -m 0600 ${logfile}.pipe to create the FIFO with root-only permissions. The subsequent tee and exec redirection lines remain unchanged.","patchTruncated":false,"patches":[{"commit":"d5d72ab38eda4a6c343b784494a4ae9d0d94bd80","patchSha256":"e0af51eb247c4727485796d1bd4fcc2c30cb34c2a733043a3371df7e94cb81f0","source":"https://github.com/MISP/MISP/commit/d5d72ab38.patch","sourceUrl":"https://github.com/MISP/MISP/commit/d5d72ab38.patch","subject":"fix: [security] Create the installer log and its FIFO"}],"source":"https://github.com/MISP/MISP/commit/d5d72ab38.patch","subject":"fix: [security] Create the installer log and its FIFO","tagVersionBoundary":{"commits_after_fix":38,"repository":"https://github.com/MISP/MISP","tag":"v2.5.47","version":"2.5.47","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-732","rationale":"The installer log file and FIFO were created under the default umask, resulting in world-readable permissions on a file containing sensitive credentials (admin password, database passwords, GPG passphrase, supervisor password). The fix explicitly sets 0600 permissions, confirming the root cause was incorrect permission assignment."},{"cweId":"CWE-22","rationale":"The log file was not removed before creation, allowing a pre-existing symlink in /var/log to redirect the write to an arbitrary file. The fix adds rm -f before creation to mitigate this symlink-following risk. This is a secondary weakness addressed by the same patch."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20100"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-95667","datePublished":"2026-09-22T13:11:44.277Z","dateReserved":"2026-09-22T13:11:36.849Z","dateUpdated":"2026-09-22T15:32:43.415Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-22 14:17:21","lastModifiedDate":"2026-09-22 16:18:21","problem_types":["CWE-22","CWE-732","CWE-732 CWE-732 Incorrect Permission Assignment for Critical Resource","CWE-22 CWE-22 Path Traversal"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-22T15:32:35.402501Z","id":"CVE-2026-95667","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"95667","Ordinal":"1","Title":"MISP Installer Log and FIFO Created World-Readable, Exposing Sen","CVE":"CVE-2026-95667","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"95667","Ordinal":"1","NoteData":"The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked. \n\nAny local unprivileged user on the system could read the log file or the FIFO to obtain these credentials. \n\nAdditionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location.\n\nVersion affected: <2.5.47","Type":"Description","Title":"MISP Installer Log and FIFO Created World-Readable, Exposing Sen"}]}}}