MISP Guard up to 1.3 Policy Enforcement improper authorization

Summaryinfo

A vulnerability labeled as problematic has been found in MISP Guard up to 1.3. This impacts the function check_required_taxonomy_exists/check_required_taxonomy_tags_allowed/check_blocked_attribute_categories/check_blocked_analyst_data_sharing_groups_uuids of the component Policy Enforcement. Such manipulation leads to improper authorization. This vulnerability is referenced as CVE-2026-116469. It is possible to launch the attack remotely. No exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in MISP Guard up to 1.3 and classified as problematic. Affected by this issue is the function check_required_taxonomy_exists/check_required_taxonomy_tags_allowed/check_blocked_attribute_categories/check_blocked_analyst_data_sharing_groups_uuids of the component Policy Enforcement. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. CVE summarizes:

MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists. An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter. The security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce. The vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-116469 since 10/26/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Applying the patch 9868b1d93fc9cc40cc7c69ca11c86afd825bbc1c is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• MISP

Name

• Guard

Version

• 1.0
• 1.1
• 1.2
• 1.3

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion