Read the docs
TI-2026-69201 Aliases CVE-2026-107278GHSA-3fqm-jh2r-j26f

MISP sync drops objects and attributes when description is empty

Priority LOW 24CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

MISP versions before 2.5.48 contain an input validation flaw in object synchronization. An object created without a description is stored correctly on its originating instance, but the receiving instance rejects it during sync because the description field is empty (CWE-20). The receiving instance then silently drops the object and all of its attributes. Any user with object-creation privileges can trigger this loss across the sync topology, and the issue is not externally exploitable in a traditional sense.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data. Preconditions: - Two or more MISP instances are configured to synchronize objects. - A user with object-creation privileges creates an object without supplying a description. - The object is subsequently synced to a peer instance. Impact: - Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline. - The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology. Affected: <2.5.48.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Fix Fixed MISP (MISP): 2.5.48

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MISPMISPbefore 2.5.482.5.48Patch availableCNA
  • MISP VendorMISP Affected before 2.5.48 Fixed in 2.5.48 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*——MISP
  • cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* Versions — — ·MISP

Remediation

MISP versions before 2.5.48 are affected, and the fix is available in MISP 2.5.48. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA MISP (MISP) Fixed in 2.5.48

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MISP 2.5.48

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-69130 Forced TOTP enrolment bypass via non-browser requests in MISPPriority LOW 31
    • TI-2026-69191 Race condition in MISP email OTP login allows one-time password reusePriority LOW 27
    • TI-2026-69128 MISP correlation engine skips refresh when event sharing changesPriority LOW 23
    Show all 4 records →

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107278
  2. 2026-10-07 Alias added: GHSA-3fqm-jh2r-j26f
  3. 2026-10-07 CISA SSVC decision points changed

References

Patch 1

  • TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
  • TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
  • TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
  • TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
  • TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
  • TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
See all 182 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences