CVE-2026-112179: MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.
As a result:
- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.
- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.
This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.
Affected: <2.5.48.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Prioritize MISP instances earlier than 2.5.48 that push events containing multiple reports to a remote MISP server through synchronization. Instances not configured for this type of remote push are not identified as affected by the provided information.
Who can receive the restricted information?
The receiving remote MISP instance can receive non-exportable tags attached to reports other than the last report in a synchronized set. This exposes restricted tag information to that remote instance.
Can this issue also disrupt synchronization?
Yes. If the last report is withheld because it is empty, synchronization can push a null report, causing the remote instance to fail to save the event.