---
id: "CVE-2026-112179"
kind: "vulnerability"
aliases: ["CVE-2026-112179"]
title: "MISP: event sync pushes non-exportable tags to remote instances, breaking event saves"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["misp", "other", "self-hosted", "threat-intel"]
not_affected_if: ["no-event-sync-push", "single-report-events"]
published_at: "2026-10-19T09:17:08+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:25:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112179", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# MISP: event sync pushes non-exportable tags to remote instances, breaking event saves

MISP's sync code filtered non-exportable tags only once after looping over all event reports, so every report except the last went to the remote instance with restricted tags still attached. When the last report was empty, a null report was pushed and the remote instance failed to save the event.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the MISP release is below `2.5.48`.
- Check whether the instance pushes events to remote servers via sync, and whether those events contain multiple reports.

## Fix

- Upgrade MISP to `2.5.48` or later.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112179

## From the sources

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.

As a result:

- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.

- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.

This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.

Affected: <2.5.48.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_