Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107278— MISP Object Sync Drops Objects and Attributes When Description Is Empty

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 在其对象同步逻辑中存在一个验证缺陷。当在 MISP 中创建一个未提供描述（description）的对象时，该对象会在源实例上正确存储。然而，当该对象通过同步机制复制到其他 MISP 实例时，接收实例的验证规则会因描述字段为空而拒绝接受该对象。结果导致接收实例静默丢弃该对象及其所有关联属性，从而造成威胁情报数据的丢失。 前提条件： 配置了两个或多个 MISP 实例以进行对象同步。 具有对象创建权限的用户创建了一个未提供描述的对象。 该对象随后被同步到对等实例。 影响： 在接收实例上，有效的对象及其属性会被

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1565.001 · Stored Data Manipulation
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107278

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP Object Sync Drops Objects and Attributes When Description Is Empty
Source: CVE Program / CVE List V5
Vulnerability Description
MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data. Preconditions: - Two or more MISP instances are configured to synchronize objects. - A user with object-creation privileges creates an object without supplying a description. - The object is subsequently synced to a peer instance. Impact: - Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline. - The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology. Affected: <2.5.48.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.48 cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-107278

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107278

请登录查看更多情报信息。

Other References for CVE-2026-107278 (1)

Same Patch Batch · MISP · 2026-10-07 · 4 CVEs total

CVE-2026-107180 7.1 HIGH MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instanc
CVE-2026-107276 6.3 MEDIUM MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurre
CVE-2026-107175 5.3 MEDIUM MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-20

V. Comments for CVE-2026-107278

No comments yet

Leave a comment