CVE-2026-116469

MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists. An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter. The security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce. The vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.

• CWE-20
• CWE-178

• https://github.com/MISP/misp-guard/commit/9868b1d93fc9cc40cc7c69ca11c86afd825bbc1c

Published

Oct 26, 2026

Last Modified

Oct 27, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11644Use after free in Views in Google Chrome on Linux prior to 1…7.5
• CVE-2026-11645Out of bounds read and write in V8 in Google Chrome prior to…8.8
• CVE-2026-11646Use after free in ViewTransitions in Google Chrome prior to …8.8
• CVE-2026-116461A vulnerability was determined in Omega Solution Restro POS …4.3
• CVE-2026-116463A vulnerability was identified in FastStone Image Viewer up …6.3
• CVE-2026-116467A security flaw has been discovered in ggml-org llama.cpp up…5.3
• CVE-2026-11647Use after free in Printing in Google Chrome on Android prior…8.3
• CVE-2026-116471A security flaw has been discovered in BKWLD Decoy up to 5.1…4.3
• CVE-2026-116476A weakness has been identified in a2aproject a2a-dotnet up t…5.4
• CVE-2026-116477A security vulnerability has been detected in a2aproject a2a…4.3
• CVE-2026-116478A vulnerability was detected in a2aproject a2a-go up to 2.4.…5.3
• CVE-2026-116479A flaw has been found in a2aproject a2a-java up to 1.2.0.Fin…4.3