MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records (CVE-2026-112180)

What is affected, what to do

Update MISP to version 2.5.48.

Affected

• MISP lte *..2.5.48

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Source: BSI CSAF, BSI WID Portal, cvelistv5, ENISA EUVD, NVD (NIST)

Vendors and products

• MISP MISP
• Open Source Misp

Weakness classes (CWE)

• CWE-459Incomplete Cleanup

  Base

  The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

  Entry at MITRE CWE-459

References & sources

• github.comSecurity patchPatch, euvd
• NVD (NIST)vuln/detail/CVE-2026-112180euvd

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 19.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: none known, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	added	—	{"id":"CVE-2026-112180","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T17:19:43.619080Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 19.10.2026ReceivedCIRCL

   CVSS V4.0: AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

   CISA assessment (SSVC): exploitation: none known, automatable: yes

   Weakness type: CWE-459

   Description added or changed

   New references:

   • https://github.com/MISP/MISP/commit/5f78634af
   Show 6 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Description	added	—	MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results. These orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces. Preconditions: - An authenticated user with sufficient privileges to delete events in MISP. - The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results. Impact: - Residual sensitive data persists in the database after the parent event is deleted. - Accumulation of orphaned records over time may contribute to storage bloat. - Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event. Affected versions: <2.5.48
   CVSS	added	—	AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
   Weakness type (CWE)	added	—	CWE-459
   Affected versions (publisher)	added	—	New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/112xxx/CVE-2026-112180.json">CVE-2026-112180</a>
   Reference	added	—	https://github.com/MISP/MISP/commit/5f78634af
   SSVC assessment	added	—	{"role":"Supplier","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T08:55:14Z"}

   Source identifier: 5a6e4751-2f3f-4070-9419-94fb35b644e8