Description
MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.

An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter.

The security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce.

The vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.
Published: 2026-10-26
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Unauthorized disclosure of threat‑intelligence data
Action: Patch Immediately
AI Analysis

Impact

MISP Guard’s policy enforcement checks perform case‑sensitive string comparisons when matching event tags, attribute categories, and sharing‑group UUIDs against configured allow or block lists. Because the comparison is case‑sensitive, an attacker who can create or modify events can craft names that differ only in letter case, such as a taxonomy tag 'TLP:AMBER' instead of the allowed 'tlp:clear' or a category 'Person' instead of a blocked 'person'. The mismatch allows the event or attribute to bypass the intended policy and be forwarded to downstream feed consumers, resulting in a breach of the confidentiality controls that MISP Guard is designed to enforce.

Affected Systems

The vulnerability affects the MISP Guard proxy component of the MISP (Malware Information Sharing Platform) ecosystem. The affected product is identified as MISP Guard. The CVE data does not specify particular versions; the fix applies to all releases of MISP Guard that include policy‑matching code.

Risk and Exploitability

The CVSS score of 7.1 indicates a high impact assessment. The EPSS score is not available, but the description notes the flaw is trivially exploitable with only normal event‑creation privileges—no authentication escalation or user interaction is required. The vulnerability is not listed in CISA’s KEV catalog. An attacker can elevate an event’s exposure by simply altering the letter case of taxonomy tags, attribute categories, or sharing‑group UUIDs, thereby bypassing configured security policies and releasing restricted intelligence to unauthorized feed consumers.

Generated by OpenCVE AI on October 26, 2026 at 12:38 UTC.

Remediation

Vendor Solution

The fix makes all policy-matching comparisons case-insensitive by applying .lower() to both the input value (tag name, attribute category, sharing-group UUID) and the configured policy value (required taxonomy prefix, allowed tags, blocked categories, blocked UUIDs) before performing the comparison. This ensures that a tag such as 'TLP:AMBER' is correctly recognized as belonging to the 'tlp' taxonomy and is checked against the allowed-tags list, and that a blocked category or UUID is matched regardless of letter case.

OpenCVE Recommended Actions

  • Apply the vendor’s latest patch that makes all policy‑matching comparisons case‑insensitive.
  • If a patch is not yet available, temporarily restrict event‑creation or modification permissions so that only trusted users can edit events that pass through MISP Guard.
  • Verify that policy enforcement is functioning by testing with sample tags, categories, and UUIDs in different letter cases to ensure mismatches are correctly detected.

Generated by OpenCVE AI on October 26, 2026 at 12:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists. An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter. The security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce. The vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.
Title MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding
First Time appeared Misp
Misp misp-guard
Weaknesses CWE-178
CWE-20
CPEs cpe:2.3:a:misp:misp-guard:*:*:*:*:*:*:*:*
Vendors & Products Misp
Misp misp-guard
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Misp Misp-guard
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-10-26T14:35:18.399Z

Reserved: 2026-10-26T10:35:05.591Z

Link: CVE-2026-116469

cve-icon Vulnrichment

Updated: 2026-10-26T14:30:31.202Z

cve-icon NVD

Status : Received

Published: 2026-10-26T11:16:37.840

Modified: 2026-10-26T15:16:40.203

Link: CVE-2026-116469

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T12:45:14Z

Weaknesses
  • CWE-178

    Improper Handling of Case Sensitivity

  • CWE-20

    Improper Input Validation