Non-exportable tags leak to remote MISP instances during event sync
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
MISP before 2.5.48 has a logic error in event synchronization: non-exportable tags are filtered only once after all event reports are iterated, not per report. An authenticated remote user with low privileges can receive restricted tag information on a remote MISP instance, because all reports except the last one are pushed with their non-exportable tags intact (CWE-200). A withheld last report also causes a null report to be pushed, which makes the remote instance fail to save the event.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance. - When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event. This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization. Affected: <2.5.48.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade to MISP 2.5.48, which fixes the issue. Versions before 2.5.48 are affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA MISP (MISP) Fixed in 2.5.48
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
MISP 2.5.48
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-76319 MISP server settings lookup exposes configuration secretsPriority LOW 31
- TI-2026-76314 Missing authorization in MISP proposal visibility exposes shadow attributesPriority LOW 31
- TI-2026-76320 MISP leaks redacted module settings and lets users edit CLI-only onesPriority LOW 24
Timeline
- 2026-10-19 Threatist record created from CVE-2026-112179
- 2026-10-19 Alias added: GHSA-xqrq-qg67-37w5
- 2026-10-20 CISA SSVC decision points changed
References
Patch 1
More MISP vulnerabilities
- TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
- TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
- TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
- TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
- TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
- TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
Sources
- CVE-2026-112179 · CVE Program
- CVE-2026-112179 · NVD
- FIRST EPSS
- GHSA-xqrq-qg67-37w5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences