CVE-2026-116372

MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules

Published Oct 26, 2026 CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Description

MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses, a malicious or compromised feed host could return a 203 or 206 status code with arbitrary content, effectively bypassing all of mispguard's filtering rules. This allowed unfiltered or malicious feed data to be ingested into the MISP instance, undermining the security controls that mispguard is designed to enforce. The vulnerability requires the attacker to control or compromise a feed endpoint configured in the MISP instance. No authentication or user interaction is required beyond the feed polling mechanism already in place.

Analysis

Technical impact

MISP mispguard allows any HTTP 2xx response other than 200 to bypass its security filtering. A feed provider that returns a 203 or 206 status code can supply arbitrary content that MISP will ingest, effectively bypassing all configured filtering rules. The vulnerability arises from improper input validation (CWE‑20) and permits an attacker with control over a feed endpoint to inject malicious data into the MISP instance without requiring authentication or additional user interaction.

Affected Systems

The vulnerability affects the MISP mispguard product (MISP::misp-guard). No specific versions are listed, so all installations of misp-guard are considered potentially impacted until the official patch is applied.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity risk. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely a compromised or malicious feed host that the MISP instance polls; the attacker must supply a 2xx status code other than 200 with payload. Because no authentication or user interaction is required beyond the normal feed polling mechanism, the risk of exploitation is significant for any MISP deployment that consumes untrusted feeds.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

MISP

misp-guard

affected

Version	Status	Constraints
`0`	affected	≤ 1.3

No data.

Vendor Product Versions

Misp

Misp-guard

Version	Status	Scheme	Platform
`[0,1.3]`	affected	generic	—

Remediation

Vendor Solution

The fix adds an explicit check in process_feed_response that rejects any HTTP response with a status code in the 201-299 range (i.e., successful responses other than 200) by returning a 403 Forbidden response. This ensures that only responses with exactly status code 200 are subject to the normal filtering pipeline, and all other 2xx responses are blocked before they can reach the MISP instance, closing the bypass vector.

OpenCVE Recommended Actions

Apply the official patch that adds an explicit check for status codes 201-299 and returns a 403 to block them before they reach the MISP instance.
Restrict the list of feed endpoints to known trusted sources and consider implementing a whitelist of permitted URLs to reduce exposure.
Review and tighten mispguard filtering rules to ensure that only explicitly allowed content is processed, and monitor the MISP logs for any unauthorized ingestions.

Generated by OpenCVE AI on October 26, 2026 at 10:27 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact High

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.362% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/MISP/misp-guard/commit/b5f606a4e57a49cc4dbf9b3ef0c6ddd19f866735

History

Nov 2, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 9:00 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses, a malicious or compromised feed host could return a 203 or 206 status code with arbitrary content, effectively bypassing all of mispguard's filtering rules. This allowed unfiltered or malicious feed data to be ingested into the MISP instance, undermining the security controls that mispguard is designed to enforce. The vulnerability requires the attacker to control or compromise a feed endpoint configured in the MISP instance. No authentication or user interaction is required beyond the feed polling mechanism already in place.
Title		MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules
First Time appeared		Misp Misp misp-guard
Weaknesses		CWE-20
CPEs		cpe:2.3:a:misp:misp-guard::::::::
Vendors & Products		Misp Misp misp-guard
References		https://github.com/MISP/misp-guard/commit/b5f606a4e57a49cc4dbf9b3ef0c6ddd19f866735
Metrics		cvssV4_0 `{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N'}`