Live › vulnerability › CVE-2026-112179
Go to dashboardMISP's sync code filtered non-exportable tags only once after looping over all event reports, so every report except the last went to the remote instance with restricted tags still attached. When the last report was empty, a null report was pushed and the remote instance failed to save the event.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any MISP instance configured to push events with multiple reports to a remote server through synchronization is exposed, because the restricted tags leak to the receiving instance. Instances that do not push events via sync, or whose events carry only one report, are not exposed to the tag disclosure.
No product ranges from the sources yet.
2.5.48.2.5.48 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.
As a result:
All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.
When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.
This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.
Affected: <2.5.48.
This page as .md · .json · in your agent: get_signal("CVE-2026-112179")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.