CVE-2026-112179 in MISP
Summary
by MITRE • 10/19/2026
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.
As a result:
- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.
- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.
This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.
Affected: <2.5.48.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability in question resides within the event synchronization mechanism of the Malware Information Sharing Platform, specifically affecting versions prior to 2.5.48. This logic error occurs during the preparation phase for remote push operations, where MISP instances exchange threat intelligence data with peer servers. The core technical flaw is a failure in loop-level filtering logic. When preparing multiple event reports for transmission, the system iterates through each report but applies the filter to remove non-exportable tags only once after the entire iteration completes, rather than applying it individually to every single report within the set. This architectural oversight means that the security control designed to restrict sensitive metadata is bypassed for all items in a batch except potentially the final one, depending on how the loop terminates and processes state.
The operational impact of this flaw is twofold, involving both information disclosure and service availability issues. First, because non-exportable tags are not stripped from individual reports before transmission, restricted tag information is inadvertently disclosed to receiving MISP instances. In a threat intelligence sharing community, certain tags may be designated as internal or sensitive, intended only for local use within an organization's specific instance. The leakage of these tags violates the principle of least privilege and can expose operational security details, such as specific investigation methods, internal project identifiers, or classified indicators that were never meant to leave the trusted boundary of the originating server. This undermines the trust model inherent in distributed threat intelligence sharing platforms where data sensitivity is often managed through tagging mechanisms.
Secondly, the logic error introduces a stability risk for remote instances receiving these synchronized events. When the last report in a set is empty or withheld due to filtering conditions, the system proceeds to push a null report structure to the remote server. This malformed payload causes the receiving MISP instance to fail when attempting to save the event data. Such failures can lead to synchronization errors, potential database inconsistencies on the receiver's end, and disruption of automated threat intelligence workflows that rely on successful event ingestion. Administrators may observe failed sync jobs or corrupted event records in their logs, requiring manual intervention to resolve the state mismatch between instances.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to properly validate and sanitize data structures before processing them for external transmission. It also relates to CWE-798 Use of Hard-coded Credentials or Information if one considers non-exportable tags as sensitive configuration data that should be strictly controlled. In terms of adversary behavior mapping under MITRE ATT&CK, this flaw could facilitate Initial Access or Collection phases by allowing an attacker who controls a peer MISP instance to harvest restricted metadata from the victim organization's threat intelligence operations. The exposure of internal tagging schemes can aid in fingerprinting organizational structures and prioritizing future attacks against specific assets identified through those tags.
Mitigation for this issue requires immediate upgrading to version 2.5.48 or later, where the synchronization logic has been corrected to apply tag filtering on a per-report basis within the iteration loop. Until an upgrade is performed, administrators should review their MISP configurations and consider restricting synchronization permissions to only fully trusted peers who do not require strict separation of sensitive internal tags. Additionally, monitoring logs for failed event saves or unexpected null payloads can help identify instances where this vulnerability has been exploited in a synchronized environment. Regular audits of tag usage policies are also recommended to ensure that non-exportable tags are used judiciously and that their accidental exposure does not compromise broader security postures.