https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 27 Oct 2026 15:27:09 +0000 https://db.gcve.eu/vuln/cve-2026-116469 <p><strong>Affected:</strong> misp-guard</p> <p>MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.</p> <p>An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the &#39;tlp&#39; taxonomy with only &#39;tlp:clear&#39; allowed, an event tagged &#39;TLP:AMBER&#39; would not be recognized as belonging to the &#39;tlp&#39; taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as &#39;Person&#39; would not match a configured block entry of &#39;person&#39;, allowing the attribute to pass through the filter.</p> <p>The security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-gro…</p> <p><strong>Affected:</strong> misp-guard</p> <p>MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.</p> <p>An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the &#39;tlp&#39; taxonomy with only &#39;tlp:clear&#39; allowed, an event tagged &#39;TLP:AMBER&#39; would not be recognized as belonging to the &#39;tlp&#39; taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as &#39;Person&#39; would not match a configured block entry of &#39;person&#39;, allowing the attribute to pass through the filter.</p> <p>The security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-gro…</p> https://db.gcve.eu/vuln/cve-2026-116469