CVE-2026-116372
Received Received - Intake

Insufficient Filtering Bypass in MISPGuard Proxy

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: CIRCL

Description
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses, a malicious or compromised feed host could return a 203 or 206 status code with arbitrary content, effectively bypassing all of mispguard's filtering rules. This allowed unfiltered or malicious feed data to be ingested into the MISP instance, undermining the security controls that mispguard is designed to enforce. The vulnerability requires the attacker to control or compromise a feed endpoint configured in the MISP instance. No authentication or user interaction is required beyond the feed polling mechanism already in place.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116372
EUVD
EUVD-2026-109666

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MISP misp-guard 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects MISP mispguard, a security proxy that filters MISP feed responses. The issue is in the process_feed_response method which only blocked non-200 HTTP responses, assuming they contained no ingestible data. However, HTTP 2xx status codes like 201, 203, or 206 were passed through unfiltered. A malicious feed host could exploit this by returning these status codes with harmful content, bypassing all security rules and allowing unfiltered data into the MISP instance.

Detection Guidance

Check MISP-guard logs for HTTP 2xx responses other than 200 being passed through without filtering. Inspect feed responses for status codes like 201, 203, or 206 that may bypass security rules.

Impact Analysis

If you use MISP mispguard, an attacker controlling a feed endpoint could inject malicious or unauthorized data into your MISP instance by returning HTTP 201, 203, or 206 responses. This bypasses security controls, potentially leading to data corruption, unauthorized access, or other security breaches in your threat intelligence platform.

Compliance Impact

This vulnerability could undermine compliance with GDPR, HIPAA, or other regulations by allowing unauthorized or malicious data ingestion into MISP. If sensitive data is processed or exposed without proper controls, it may violate data protection requirements, leading to legal penalties or reputational damage.

Mitigation Strategies

Update MISP-guard to the patched version that blocks all 2xx responses except 200. Review feed configurations to ensure no untrusted feeds are allowed. Monitor logs for suspicious feed responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116372. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart