MISP SQL injection: what it means for API key governance

TL;DR: An authenticated attacker with a valid API key could inject SQL through the events listing order parameter in MISP and extract stored API keys, event data, and database internals from affected deployments, according to Safe Security details CVE-2026-44381. The issue turns API key distribution into a governance problem, not just an access-control problem.

Editorial analysis by NHI Mgmt Group, based on content published by Safe Security: “CVE-2026-44381 MISP Threat Intelligence Platform Authenticated SQL Injection via ORDER BY Parameter POST /events/index — Boolean-Blind + Time-Based Oracle”.

By the numbers:

• over 6,000 organizations worldwide use MISP, including national CERTs, financial sector ISACs, government agencies, and security operations teams.
• CVE-2026-44381 is rated MEDIUM with a CVSS 5.3 score.

Key questions

Q: What breaks when an authenticated API parameter reaches SQL ordering logic without a whitelist?

A: The application loses control of query structure, so an attacker can turn a harmless-looking sort field into a database execution primitive.

Q: Why does a read-only SQL injection path still create account takeover risk in shared platforms?

A: Because the database often stores credentials, tokens, and other delegated trust material alongside normal records.

Q: How can security teams detect SQL injection?

A: Security teams detect SQL injection by monitoring application and database logs for malformed queries, repeated syntax errors, unexpected query patterns and parameter abuse.

Practitioner guidance

• Whitelisting of all user-controlled sort fields Replace character allowlists with explicit field-name whitelists for every endpoint that maps request data into SQL ordering logic.
• Rotate and revoke exposed API authkeys Assume any authkey reachable through the affected database path may already be compromised, then issue new keys and revoke unused ones.
• Hunt for extraction and oracle patterns in logs Review requests to POST /events/index for parentheses, SELECT, SLEEP, information_schema, and hex literals, then correlate them with abnormal timing or error spikes.

Bottom line: The vulnerability shows how unsafe query construction in a threat-intelligence platform can expose both sensitive records and the machine credentials that protect them.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →