Critical severity · published Apr 9, 2026
CVE-2026-39962
LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable
9.6
CVSS
0.3%
EPSS
No
On KEV
Description
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAuthenticate.apacheEnv is configured to use a user-controlled server variable instead of REMOTE_USER (such as in certain proxy setups). An attacker able to control that value can manipulate the LDAP search filter and potentially bypass authentication constraints or cause unauthorized LDAP queries. This vulnerability is fixed in 2.5.36.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
MISP · MISP
< 2.5.36 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-39962
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-39962
Patch
https://github.com/MISP/MISP/commit/380ee4136a7d9ce2fe63fce06d517839f30aba10
Patch
https://github.com/MISP/MISP/commit/d7d671ea8f5822e91207dcad2003c35c30092a32
Product
https://github.com/MISP/MISP/releases/tag/v2.5.36
Vendor Advisory
https://github.com/MISP/MISP/security/advisories/GHSA-mc53-48w8-9g63
More from MISP
10.0
CVE-2026-10611
OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled
9.8
CVE-2026-85216
MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
9.4
CVE-2026-56422
MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields
9.3
CVE-2026-103655
MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
9.3
CVE-2026-90961
MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials