CVE-2026-56447: MISP Kafka Configuration Arbitrary Code Execution – Insider Threat

Technical summary

CVE-2026-56447 is an Insecure Configuration/Arbitrary File Path vulnerability (CWE-829) in MISP's Kafka integration. The Kafka_rdkafka_config parameter accepts user-supplied filesystem paths without validation, allowing authenticated administrators to reference arbitrary INI files. MISP then parses these files and passes their options directly to the rdkafka library. An attacker exploits this by crafting a malicious INI file with rdkafka directives such as plugin.library.paths pointing to external libraries, which rdkafka loads and executes. Because MISP-writable locations (file uploads, administrative image directories) are not excluded from the path restrictions, an attacker can host the payload within the MISP application's own filesystem and reference it. The vulnerability requires authenticated administrator access, limiting the attack surface but creating a critical insider threat vector. The patch implements path canonicalization and whitelisting, restricting the setting to predefined, writable-protected directories outside the web and upload trees.

Business impact

This vulnerability represents a significant insider threat and post-compromise escalation risk for organizations operating MISP. A malicious or compromised administrator account can achieve code execution with the privileges of the MISP application process, potentially leading to full system compromise, lateral movement to connected threat intelligence systems, data exfiltration of ingested intelligence, and manipulation of threat feeds trusted by downstream security tools. Organizations relying on MISP for central threat intelligence aggregation face the risk of poisoned intelligence data affecting defensive decisions across the enterprise. Additionally, if the MISP host has network or filesystem access to other critical systems, the attacker can pivot further. For security teams, this underscores the criticality of rigorous administrator access controls and immediate patching in MISP deployments.

Affected systems

CVE-2026-56447 affects MISP (Malware Information Sharing Platform) installations prior to the version that includes the configuration restriction fix. The vulnerability requires administrative access to trigger, so the impact scope is limited to environments where MISP user roles and privilege management are in use. Any MISP instance exposed to untrusted or insufficiently vetted administrators is at risk. The vulnerability does not require network access to exploit—administrator authentication is the sole prerequisite. MISP installations in isolated or air-gapped environments are not immune if an insider with administrator privileges is compromised.

Exploitability

Exploitability is moderate to high within scope. The attack requires valid authenticated administrator credentials—a significant barrier for external attackers but a realistic threat for insider or post-compromise scenarios. Once authenticated, no additional user interaction is required; the attacker can modify the configuration setting directly and trigger MISP to parse the malicious file. The payload delivery mechanism is straightforward: the attacker uploads a crafted INI file to a known MISP-writable location (e.g., via the upload functionality) or leverages an existing administrative image directory, then changes the Kafka_rdkafka_config setting to reference it. The rdkafka library's plugin loading is not inherently robust to untrusted configuration, making exploitation reliable. The CVSS score of 7.2 (HIGH) reflects the high impact of code execution balanced against the high privilege requirement.

Remediation

Organizations must patch MISP to the version restricting Kafka_rdkafka_config to approved configuration directories outside the webroot and upload targets. Immediately audit all current Kafka_rdkafka_config values in production MISP instances to identify any suspicious or non-standard paths. Review administrator accounts and access logs for unauthorized configuration changes, particularly around Kafka settings. Implement principle-of-least-privilege for MISP administrator roles, ensuring only trusted personnel retain administrative capabilities. Consider network segmentation: isolate MISP from systems that would be attractive pivot targets if compromised. Until patching is complete, disable or do not use the Kafka integration if not actively required. Establish configuration management practices that log and alert on Kafka-related setting changes.

Patch guidance

Apply the official MISP patch that implements path validation and restricts Kafka_rdkafka_config to whitelisted directories. Verify against the vendor advisory (MISP project) for the exact version number and any preconditions. After patching, reset any non-compliant Kafka_rdkafka_config values to approved directories. Test the patch in a staging environment to confirm Kafka functionality continues as expected if the integration is in use. No data loss or functional degradation is expected from this patch, as it only restricts path input. Prioritize patching any MISP instances accessible to untrusted or shared administrator accounts.

Detection guidance

Monitor MISP configuration files and logs for changes to the Kafka_rdkafka_config setting, particularly any modifications that reference paths outside standard configuration directories (e.g., within /uploads, /tmp, or the webroot). Audit file upload activity and cross-reference with timing of Kafka configuration changes. Check for suspicious INI files created or modified in MISP-writable directories, especially those containing plugin.library.paths directives. Review rdkafka process execution and library loading; unexpected .so or .dll files being loaded by the MISP process are a red flag. Implement file integrity monitoring on approved Kafka configuration directories to detect unauthorized modifications. Set up alerts for administrator-level MISP configuration changes in general, as this is a high-risk operation.

Why prioritize this

Although CVE-2026-56447 requires authenticated administrator access (a significant limiting factor), the impact of successful exploitation—arbitrary code execution—is severe and provides complete system compromise and lateral movement capability. The vulnerability is not yet listed on CISA's KEV catalog, suggesting real-world exploitation has not been widely reported, but this is a known attack pattern exploitable by insiders or following other account compromises. Organizations with MISP deployments should prioritize patching to eliminate this insider threat vector and close a post-compromise escalation path. The 7.2 CVSS HIGH score reflects both the critical impact and the authentication barrier.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) is assigned with Attack Vector = Network, Attack Complexity = Low, Privileges Required = High, User Interaction = None, and impact scope Unchanged with High confidentiality, integrity, and availability impact. The Network AV and Low AC indicate that once authenticated, exploitation is straightforward and can be triggered remotely. The High PR reflects the need for administrator credentials, preventing opportunistic external attacks. The high C/I/A impact captures the consequence of arbitrary code execution: full system compromise, data exfiltration, and denial of service potential. This scoring appropriately positions the vulnerability as requiring urgent attention for affected organizations, even with the elevated privilege requirement.

Frequently asked questions