{"id":"CVE-2026-112179","kind":"vulnerability","aliases":["CVE-2026-112179"],"related":[],"title":"MISP: event sync pushes non-exportable tags to remote instances, breaking event saves","description":"In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.\n\nAs a result:\n\n- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.\n\n- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.\n\nThis issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.\n\nAffected: <2.5.48.","summary":"MISP's sync code filtered non-exportable tags only once after looping over all event reports, so every report except the last went to the remote instance with restricted tags still attached. When the last report was empty, a null report was pushed and the remote instance failed to save the event.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["misp","other","self-hosted","threat-intel"],"not_affected_if":["no-event-sync-push","single-report-events"],"how_to_check":"- Confirm the MISP release is below `2.5.48`.\n- Check whether the instance pushes events to remote servers via sync, and whether those events contain multiple reports.","fix":"- Upgrade MISP to `2.5.48` or later.","status":"open","published_at":"2026-10-19T09:17:08+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:25:25+00:00","updated_at":"2026-10-25T04:25:25+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:25:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MISP to `2.5.48` or later.","reach":"network","title":"MISP: event sync pushes non-exportable tags to remote instances, breaking event saves","impact":"medium","summary":"MISP's sync code filtered non-exportable tags only once after looping over all event reports, so every report except the last went to the remote instance with restricted tags still attached. When the last report was empty, a null report was pushed and the remote instance failed to save the event.","category":"other","nicknames":[],"who_cares":["misp","threat-intel","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Restricted tag names leak to a sync partner; some event saves fail.","analyst_note":"","how_to_check":"- Confirm the MISP release is below `2.5.48`.\n- Check whether the instance pushes events to remote servers via sync, and whether those events contain multiple reports.","needs_analyst":false,"not_affected_if":["no-event-sync-push","single-report-events"],"who_is_affected":"Any MISP instance configured to push events with multiple reports to a remote server through synchronization is exposed, because the restricted tags leak to the receiving instance. Instances that do not push events via sync, or whose events carry only one report, are not exposed to the tag disclosure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.001008,"input_tokens":3428,"output_tokens":1331,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112179':17A,20A '-2026':16A,19A '2.5.48':203C 'affect':185C,202C 'appli':109C 'attach':61B 'break':12A 'caus':174C 'code':32B 'configur':189C 'contain':88C 'cve':15A,18A 'disclos':151C 'effect':150C 'empti':67B,168C 'error':91C 'event':2A,13A,44B,81B,85C,96C,182C,192C 'everi':47B 'except':49B,129C 'export':7A,36B,106C,147C 'fail':77B,179C 'filter':33B,102C 'host':25B 'individu':122C 'inform':154C 'instanc':11A,56B,76B,142C,158C,177C,188C 'intact':149C 'intel':28B 'issu':184C 'iter':114C 'last':51B,64B,131C,161C 'logic':90C 'loop':41B 'misp':1A,21B,29B,83C,141C,187C 'multipl':194C 'non':6A,35B,105C,146C 'non-export':5A,34B,104C,145C 'null':69B,170C 'one':132C 'prepar':94C 'process':87C 'push':4A,72B,100C,137C,173C,191C 'rather':118C 'receiv':157C 'remot':10A,55B,75B,99C,140C,176C,198C 'report':45B,48B,65B,70B,97C,117C,123C,128C,162C,171C,195C 'restrict':58B,152C 'result':126C 'save':14A,79B,180C 'self':24B 'self-host':23B 'server':199C 'set':135C,165C 'still':60B 'sync':3A,31B 'synchron':86C,201C 'tag':8A,37B,59B,107C,148C,153C 'threat':27B 'threat-intel':26B 'via':200C 'went':52B 'withheld':167C","nicknames":[],"mitigations":[],"who_affected":"Any MISP instance configured to push events with multiple reports to a remote server through synchronization is exposed, because the restricted tags leak to the receiving instance. Instances that do not push events via sync, or whose events carry only one report, are not exposed to the tag disclosure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5a6e4751-2f3f-4070-9419-94fb35b644e8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112179","severity":null,"published_at":"2026-10-19T09:17:08+00:00","modified_at":"2026-10-19T19:17:25+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}