PT-2026-31660 · Misp+1 · Misp+1

Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-39962

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.36

Description MISP is a threat intelligence and sharing platform. A flaw exists in the LDAP query handling within ApacheAuthenticate.php, specifically due to improper neutralization of special elements. This allows for LDAP injection via manipulation of the username value when ApacheAuthenticate.apacheEnv is configured to utilize a user-controlled server variable instead of REMOTE USER. An attacker controlling this variable can modify the LDAP search filter, potentially bypassing authentication or executing unauthorized LDAP queries.

Recommendations Update to version 2.5.36 or later.

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2026-39962

Affected Products

Apache

Misp

References · 6

• https://github.com/MISP/MISP/commit/380ee4136a7d9ce2fe63fce06d517839f30aba10 · Patch
• https://github.com/MISP/MISP/commit/d7d671ea8f5822e91207dcad2003c35c30092a32 · Patch
• https://github.com/MISP/MISP/security/advisories/GHSA-mc53-48w8-9g63 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39962 · Security Note
• https://github.com/MISP/MISP/releases/tag/v2.5.36 · Note
• https://twitter.com/CVEnew/status/2042302792724070454 · Twitter Post