CVE-2026-39962 is a critical LDAP injection flaw (CVSS 9.6) in MISP, the threat intelligence sharing platform. ApacheAuthenticate.php puts an unsanitized username into an LDAP search filter when apacheEnv points to a user-controllable variable. MISP versions before 2.5.36 are affected, and 2.5.36 fixes it.
What's affected
MISP before 2.5.36 is affected. The fixed version is 2.5.36.
The advisory ties the flaw to ApacheAuthenticate.apacheEnv being set to a user-controlled server variable instead of REMOTE_USER, as in certain proxy setups. Installations using the default are described as less exposed, but upgrade anyway.
How to check if you're exposed
Check the MISP version in the web interface footer, and review your configuration:
grep -rn "apacheEnv" app/Config/config.php
If you use Apache or proxy based authentication, confirm which variable carries the username and who can influence it.
What to do now
- Upgrade MISP to 2.5.36 or later.
- If you use ApacheAuthenticate, check that apacheEnv does not use a value a client can set.
- Make sure your proxy strips client supplied authentication headers.
- Review authentication logs for unusual usernames.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
This is CWE-90 (LDAP Injection). A username inserted into an LDAP filter without escaping lets special characters change the filter itself, which can loosen authentication checks or trigger unintended queries.
The lesson applies to any single sign-on arrangement. The identity value that a front proxy passes along must come from a source the client cannot forge. The record does not flag this CVE as exploited in the wild.
Quick check
Which setting makes it risky?
ApacheAuthenticate.apacheEnv set to a user-controlled variable rather than REMOTE_USER.
What is the fixed version?
2.5.36.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
