In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.
As a result:
- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.
- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.
This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.
Affected: <2.5.48.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/MISP/MISP/commit/0be4564a9 |
Configurations
No configuration.
History
19 Oct 2026, 09:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-19 09:17
Updated : 2026-10-19 19:17
NVD link : CVE-2026-112179
Mitre link : CVE-2026-112179
CVE.ORG link : CVE-2026-112179
JSON object : View
Products Affected
No product.
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor