CVE-2026-112179: MISP Information Disclosure Vulnerability

CVE-2026-112179 Overview

CVE-2026-112179 is an information disclosure vulnerability in Malware Information Sharing Platform (MISP) affecting versions prior to 2.5.48. The flaw resides in the event synchronization process that prepares event reports for remote push. A logic error applied the non-exportable tag filter only once after iterating over all reports, instead of to each individual report. As a result, every report except the last in the set was pushed to the remote MISP instance with its restricted tags intact. When the final report in the set was withheld, a null report was pushed, causing the receiving instance to fail saving the event. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Any MISP instance configured to push multi-report events to a remote server leaks non-exportable tag metadata and can cause save failures on the receiving instance.

Affected Products

MISP versions earlier than 2.5.48
MISP instances configured for event synchronization push
Deployments pushing events containing multiple event reports

Discovery Timeline

2026-10-19 - CVE-2026-112179 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-112179

Vulnerability Analysis

MISP is a threat intelligence sharing platform where instances synchronize events, attributes, and reports with trusted remote servers. Tags marked as non-exportable are intended to remain local and must be stripped before any outbound push. The synchronization routine responsible for preparing EventReport objects iterated over every report, calling __updateEventReportForSync, but applied __removeNonExportableTags only once after the loop completed. Because the filter was called with the loop variable $key retained from the final iteration, only the last report in the collection received tag sanitization. All preceding reports were transmitted with restricted tag data intact, exposing sensitive classification metadata to the receiving instance.

Root Cause

The root cause is a scope and control-flow error in the __prepareEventReportForSync logic inside app/Model/Event.php. The call to remove non-exportable tags was placed outside the foreach loop that processes each report. A secondary effect occurs when the final report is empty and gets unset: the subsequent indexed access to $data['EventReport'][$key] references a key that no longer exists, producing a null entry that the remote instance rejects when attempting to save the event.

Attack Vector

Exploitation requires authenticated synchronization between MISP instances. An operator on the pushing instance only needs to configure normal event synchronization with multiple reports attached to an event. The receiving instance passively obtains the restricted tag information with no additional interaction, satisfying the network attack vector characterization in the CVSS metrics.

php

                 $data['EventReport'][$key] = $this->__updateEventReportForSync($report, $server);
                 if (empty($data['EventReport'][$key])) {
                     unset($data['EventReport'][$key]);
+                } else {
+                    $data['EventReport'][$key] = $this->__removeNonExportableTags($data['EventReport'][$key], 'EventReport', $server);
                 }
             }
             $data['EventReport'] = array_values($data['EventReport']);
         }
         if (isset($data['EventReport']) && empty($data['EventReport'])) {
             unset($data['EventReport']);
-        } else {
-            $data['EventReport'][$key] = $this->__removeNonExportableTags($data['EventReport'][$key], 'EventReport', $server);
         }
         return $data;
     }

Source: GitHub MISP Commit 0be4564. The patch relocates __removeNonExportableTags inside the per-report loop so every report is sanitized individually.

Detection Methods for CVE-2026-112179

Indicators of Compromise

Remote MISP instances receiving event reports that contain tags flagged as non-exportable on the source instance.
Synchronization job failures on the receiving MISP instance with errors tied to saving event reports with null payloads.
Discrepancies between the local tag export policy and the tag set present on reports stored at downstream peers.

Detection Strategies

Audit outgoing synchronization payloads by capturing the JSON pushed to remote servers and comparing report-level tag arrays against the server's non-exportable tag list.
Query the MISP database on receiving instances for event reports carrying tags that should be marked local-only by policy.
Review MISP server logs for saveEvent failures associated with empty or null EventReport entries during push operations.

Monitoring Recommendations

Enable verbose logging on the Servers push workflow and forward MISP application logs to a central analytics platform for correlation.
Track synchronization success and failure rates per peer to surface anomalies after upgrading or configuration changes.
Alert on new or unexpected tags appearing on remote peers that originate from your instance.

How to Mitigate CVE-2026-112179

Immediate Actions Required

Upgrade all MISP instances to version 2.5.48 or later to apply the official fix in commit 0be4564a9.
Inventory peers that received pushes from affected instances and review whether restricted tag metadata was disclosed.
Rotate or reclassify any intelligence whose confidentiality depended on non-exportable tag enforcement during synchronization.

Patch Information

The vendor fix is included in MISP 2.5.48. The patch moves the __removeNonExportableTags invocation inside the per-report loop in app/Model/Event.php, ensuring every EventReport is sanitized before transmission. See the GitHub MISP Commit 0be4564 for the exact change set.

Workarounds

Temporarily disable push synchronization to remote servers until the upgrade is applied.
Restrict events to a single report per event in outbound sharing groups until all pushing instances are patched.
Remove or re-tag non-exportable tags on events scheduled for synchronization to avoid relying on the broken filter.

bash

# Verify installed MISP version and upgrade
cat /var/www/MISP/VERSION.json
cd /var/www/MISP && sudo -u www-data git fetch --tags
sudo -u www-data git checkout v2.5.48
sudo -u www-data /var/www/MISP/app/Console/cake Admin updateDatabase