CVE-2026-107278 in MISP
Summary
by MITRE • 10/07/2026
MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.
Preconditions:
- Two or more MISP instances are configured to synchronize objects.
- A user with object-creation privileges creates an object without supplying a description.
- The object is subsequently synced to a peer instance.
Impact:
- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.
- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.
Affected: <2.5.48.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified within MISP versions prior to 2.5.48 represents a critical logic error in the object synchronization mechanism that compromises the integrity of threat intelligence sharing between distributed instances. This flaw stems from an inconsistency in validation rules applied during local creation versus remote replication processes. When a user with appropriate privileges creates a new Object directly on a primary MISP instance, the system accepts entries even if the description field is left empty or null. The object and its associated attributes are stored correctly within the local database without triggering any warnings or errors for this specific omission. However, when this same object is transmitted to a peer instance via the synchronization protocol, the receiving server applies stricter validation logic that mandates a non-empty description field. Consequently, the receiving instance rejects the incoming payload at the application layer rather than persisting it in its local database.
This discrepancy creates a silent failure mode where data loss occurs without immediate notification to the user or administrator on either end of the synchronization link. The primary operational impact is the degradation of threat intelligence fidelity across the entire sync topology. Since MISP relies heavily on accurate and complete object replication to maintain a unified view of cyber threats, the dropping of objects means that critical indicators such as IP addresses, domain names, file hashes, or behavioral descriptions are missing from receiving instances. This fragmentation undermines collaborative security efforts, potentially leaving downstream systems blind to active campaigns represented by those specific attributes. The issue is not an external exploitation vector in terms of remote code execution or unauthorized access but rather a functional defect that can be triggered by any authorized user who fails to populate the description field during object creation.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, specifically where input validation differs between entry points within the same application logic flow. It also relates to CWE-697 Incorrect Comparison, as the system inconsistently evaluates the validity of an empty string depending on whether it originates from local user input or remote synchronization traffic. In terms of MITRE ATT&CK mapping, this behavior does not directly map to a specific adversary tactic but represents a systemic weakness that could be leveraged indirectly if an attacker were able to manipulate object creation processes to disrupt intelligence sharing, although the current scope is limited to accidental data loss by legitimate users. The absence of error logging or user feedback regarding dropped objects exacerbates the issue, making it difficult for administrators to detect and remediate the problem in real time without auditing synchronization logs manually.
Mitigation requires upgrading MISP instances to version 2.5.48 or later where this validation logic has been corrected to ensure consistency across both local creation and remote synchronization paths. Administrators should also implement monitoring solutions that track synchronization success rates and alert on high volumes of dropped objects, providing an early warning system for similar logical flaws in the future. Additionally, enforcing stricter input policies at the user interface level can prevent users from submitting empty descriptions during object creation, thereby reducing the likelihood of encountering this issue before a patch is applied. Ensuring that all instances in a sync group are running compatible versions minimizes the risk of asymmetric validation failures disrupting the flow of critical threat intelligence data.