Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112179— MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 MISP 中，事件同步流程在准备用于远程推送的事件报告时存在逻辑错误：对不可导出标签的过滤操作仅在遍历完所有报告后执行了一次，而非针对每个单独的报告分别执行。 由此导致以下后果： 除集合中的最后一个报告外，其余所有报告均连同其不可导出的标签被完整推送到远程 MISP 实例，从而将受限的标签信息泄露给接收方实例。 当集合中的最后一个报告被过滤为空时，系统会推送一个空报告（null report），导致远程实例无法保存该事件。 此问题影响所有配置为通过同步功能向远程服务器推送包含多个报告的事件的 MISP 实例。

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112179

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
Source: CVE Program / CVE List V5
Vulnerability Description
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance. - When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event. This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization. Affected: <2.5.48.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.48 cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-112179

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112179

请登录查看更多情报信息。

Other References for CVE-2026-112179 (1)

Same Patch Batch · MISP · 2026-10-19 · 7 CVEs total

CVE-2026-112178 7.1 HIGH MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access C
CVE-2026-112188 7.1 HIGH MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolutio
CVE-2026-112192 5.3 MEDIUM MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Setting
CVE-2026-112180 5.1 MEDIUM MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
CVE-2026-112184 4.8 MEDIUM MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Lab
CVE-2026-112183 4.8 MEDIUM MISP CSS Injection via Remote Tag Colour in Event Preview

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-200

V. Comments for CVE-2026-112179

No comments yet

Leave a comment