CVE-2026-56447: MISP remote code execution via arbitrary rdkafka configuration path

Synopsis

This is a remote code execution vulnerability in MISP (Malware Information Sharing Platform) caused by an unsafe file-path configuration setting. An authenticated site administrator can point the Kafka_rdkafka_config setting to an attacker-controlled INI file anywhere on the filesystem; MISP then parses that file and passes its options to the rdkafka library, which accepts a plugin.library.paths option that instructs rdkafka to load an arbitrary shared library. Successful exploitation gives the attacker code execution with the full privileges of the MISP process. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MISP web interface over the network to interact with the affected administrative setting.

• AuthenticationRequired

  A site administrator account (high-privilege) is required; a low-privilege user account is not sufficient to change the Kafka_rdkafka_config setting.

• Victim interactionNot required

  No victim interaction is needed; the attacker exercises the exploit entirely through their own authenticated session.

• Attack complexityDetail

  Exploit complexity is low: no race conditions or special environmental conditions are required beyond having admin credentials and a writable location on the MISP host for the malicious INI file.

Blast Radius

• Reads sensitive data from any file the MISP process can access, including stored event data, sharing group memberships, and API keys held in MISP configuration files.
• Modifies or deletes persisted threat intelligence records, sharing rules, and database contents by executing attacker-supplied code in the MISP process context.
• Achieves lateral movement or persistent access to the host and any systems reachable from it, because the injected shared library runs with the full OS privileges of the MISP process user.
• Exfiltrates or corrupts data shared with connected MISP instances over its synchronization feeds, extending the blast radius beyond the compromised node.