Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116372— MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules

Quick assessment

Affected
MISP misp-guard
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP mispguard 是一款安全过滤代理，其功能是根据配置的规则检查并阻断 MISP 数据源（feed）的响应。src/mispguard.py 中的 process_feed_response 方法负责在响应到达 MISP 实例之前对其进行评估。原始逻辑仅显式处理了 HTTP 状态码非 200 的情况：当状态码不是 200 时，系统会直接放行响应而不过滤，其假设是“非 200 的响应不会包含可被导入的事件数据”。然而，除 200 之外的其他 2xx 状态码（例如 201 Created、203 Non-A

CVSS 7.7 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116372

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules
Source: CVE Program / CVE List V5
Vulnerability Description
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses, a malicious or compromised feed host could return a 203 or 206 status code with arbitrary content, effectively bypassing all of mispguard's filtering rules. This allowed unfiltered or malicious feed data to be ingested into the MISP instance, undermining the security controls that mispguard is designed to enforce. The vulnerability requires the attacker to control or compromise a feed endpoint configured in the MISP instance. No authentication or user interaction is required beyond the feed polling mechanism already in place.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP misp-guard 0 ~ 1.3 cpe:2.3:a:misp:misp-guard:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-116372

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116372

请登录查看更多情报信息。

Other References for CVE-2026-116372 (1)

IV. Related Vulnerabilities

Same product: misp-guard
Same vendor: MISP
Same weakness: CWE-20