MISP 2.5.37 patches SQL injection, privesc bugs
MISP 2.5.37 ships a new Event Templating system and fixes three vulnerabilities, including a blind SQL injection and an auth-key privilege escalation to site admin.
Sourcemisp-project.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The MISP project released version 2.5.37, primarily notable for a ground-up rewrite of its event templating engine, a new dedicated `suricata` attribute type, continued UI migration to the Overmind (Bootstrap 5) theme, and a switch to the upstream STIX 2 library. Alongside these feature changes, the release addresses three security issues that were responsibly disclosed and assigned GCVE identifiers.
The most significant fix addresses a blind SQL injection vulnerability where user-controlled `order`/`sort` parameters on `POST /events/index` and `GET /shadow_attributes/index` reached the SQL `ORDER BY` clause without validation, allowing any authenticated user — including read-only accounts — to extract arbitrary database content. A second issue allowed an organisation admin sharing an org with a site admin to reset that site admin's authentication key via `POST /users/resetauthkey/<id>` and retrieve the new key in the response, enabling privilege escalation to full site-admin access. A third, lower-severity fix enforces RFC 4122 validation on Collection UUIDs. All three were reported by external researchers (Jeroen Gui and Jeroen Pinoy) and are fixed in this release with no indication of in-the-wild exploitation.
Given MISP's broad deployment across threat intelligence teams, CERTs, and information-sharing communities, administrators should prioritize upgrading to 2.5.37, particularly to close the privilege-escalation and SQL injection paths, both of which are exploitable by any authenticated, low-privileged user.
Source reporting: https://www.misp-project.org/2026/04/29/misp.2.5.37.released.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs