CVE-2026-112179
Deferred Deferred - Pending Action

Event Report Synchronization Logic Error in MISP

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CIRCL

Description
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance. - When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event. This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization. Affected: <2.5.48.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112179
EUVD
EUVD-2026-104128

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MISP MISP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP involves a logic error during event synchronization where non-exportable tags were not properly filtered for each report. Instead, filtering was applied only once after processing all reports, causing all but the last report to retain their non-exportable tags when pushed to a remote instance. This could lead to unauthorized disclosure of restricted tag information.

Detection Guidance

Check MISP synchronization logs for events with multiple reports where non-exportable tags were pushed incorrectly. Look for null reports or failed event saves on remote instances. Review the commit diff in the MISP repository to identify if the vulnerable code path is present.

Impact Analysis

If you use MISP with event synchronization to a remote server, this flaw could expose sensitive tag data to unintended recipients. Additionally, if the last report in a set is empty, a null report is pushed, causing the remote instance to fail saving the event.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, potentially violating GDPR or HIPAA requirements for data protection and confidentiality. Organizations using MISP must ensure proper tag filtering to maintain compliance.

Mitigation Strategies

Upgrade MISP to version 2.5.48 or later to apply the fix. If upgrading is not immediately possible, disable event synchronization with remote instances until the update is applied. Monitor synchronization logs for signs of the vulnerability being exploited.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112179. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart