CVE-2026-86452

MISP versions 2.5.45 and earlier accept attacker-controlled email input on the unauthenticated forgot-password reset endpoint without a length bound or format validation, persisting the supplied value twice per request (once in an audit log entry and once in a queued password-reset job) with no rate limiting. An unauthenticated attacker can repeatedly submit oversized or arbitrary values to this and similar pre-auth paths (registrations, failed REST authentication attempts), driving unbounded growth of persistent storage and queued work. The result is high availability impact (CVSS 4.0 8.7, VA:High): resource exhaustion can degrade or disrupt the instance, while confidentiality and integrity are unaffected. Any MISP deployment running 2.5.45 or earlier is affected, particularly instances where the pre-auth reset flow is reachable by untrusted users. No public PoC, no CISA KEV listing, and an EPSS of about 0.3% indicate no known exploitation at this time.

What to do: Upgrade MISP to a release newer than 2.5.45, which adds the 1024-byte email length cap, email-format validation before persistent work, a per-source pre-auth request budget with HTTP 429 responses, and a 15-minute cooldown for API-access request emails. Until patched, rate-limit or restrict unauthenticated access to the forgot-password and other pre-auth endpoints at a reverse proxy or WAF, and monitor audit-log and job-queue growth for signs of storage exhaustion. Also verify the API-access request endpoint is POST-only with CSRF protection in the deployed version.