Description
The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked. 

Any local unprivileged user on the system could read the log file or the FIFO to obtain these credentials. 

Additionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location.

Version affected: <2.5.47
Published: 2026-09-22
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

The installer scripts now explicitly create the log file with 0600 permissions using install -m 0600 and the FIFO with mkfifo -m 0600, ensuring both are root-readable/writable only from the moment of creation. The log file is also removed (rm -f) before creation to prevent a pre-existing symlink in /var/log from being used to redirect the write to an attacker-controlled path. This matches the existing 0600 treatment applied to /root/misp_settings.txt by the save_settings() function.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked.  Any local unprivileged user on the system could read the log file or the FIFO to obtain these credentials.  Additionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location. Version affected: <2.5.47
Title MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
Weaknesses CWE-22
CWE-732
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-22T13:11:44.277Z

Reserved: 2026-09-22T13:11:36.849Z

Link: CVE-2026-95667

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-22T14:17:21.593

Modified: 2026-09-22T14:17:21.693

Link: CVE-2026-95667

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-732

    Incorrect Permission Assignment for Critical Resource