GCVE-1-2026-20283 (CVE-2026-112179)

Vulnerability from gna-1 – Published: 2026-10-19 08:53 – Updated: 2026-10-19 08:53
VLAI
Title
MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
Summary
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance. - When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event. This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization. Affected: <2.5.48.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
Supplier · CNA (v2.0.3)
Decision recorded 2026-10-19 08:52 UTC
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
CIRCL GNA GNA-1
GNA scorecard A 90/100 over 252 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
MISP MISP Affected: 0 , < 2.5.48 (semver)
    cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
iglocska Claude Opus 5.5 (1M context) elhoim
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-10-19 08:52
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/0be4564a9.patch 4195b30bddf4…
Confidence
medium
Commit Subject Patch SHA-256
0be4564a98f3 fix: [sync] Filter the tags of every event report pushed to a 4195b30bddf4…
Fix summary

The non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable.

Patch summary

In app/Model/Event.php, the call to __removeNonExportableTags was moved from a single post-loop invocation (which used the last $key value from the foreach) into the else branch of the loop body, so it executes for each non-empty report individually. The post-loop else block that applied the filter to a single report was removed, eliminating both the tag-leakage bug and the null-report push when the last report was empty.

CVSS rationale

AV:N: The vulnerability is triggered over the network during MISP-to-MISP synchronization. AC:L: No special conditions are needed beyond a configured sync relationship and an event with multiple reports. AT:N: No attacker interaction is required; the bug triggers on any sync push. PR:L: An authenticated user with permission to push events to a remote server is required. UI:N: No user interaction beyond initiating the sync. VC:L: Non-exportable tags (restricted metadata) are disclosed to the remote instance; the core event data is not exposed. VI:N, VA:N: No integrity or availability impact on the local instance. SC:N, SI:N, SA:N: No impact on the remote instance's confidentiality, integrity, or availability beyond receiving the tags it should not have.

Weakness rationale
  • CWE-200 Tags explicitly marked as non-exportable were not filtered from event reports during synchronization, exposing restricted information to the remote MISP instance. The root cause is a logic error (filter applied once instead of per-item), but the security consequence is information disclosure.
Attack pattern rationale
  • CAPEC-128 This is the closest available CAPEC pattern. The vulnerability arises from a code logic error that causes data (non-exportable tags) to be improperly exposed during a legitimate sync operation. The mapping is uncertain because the issue is a logic bug in data filtering rather than a deliberate attacker action; no CAPEC pattern precisely covers 'improper per-item filtering in a loop causing data leakage during a legitimate API operation.'
Assumptions to verify
  • The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 34 commits after fix), suggesting the fix is included in v2.5.48 and prior versions are affected. No explicit version range is stated in the patch.
  • PR:L assumes that a non-admin authenticated user with push-to-remote permissions can trigger the sync; if only administrators can initiate sync, PR should be raised to H.
  • The CAPEC-128 mapping is uncertain; no CAPEC pattern precisely describes a per-item filtering logic error causing data leakage during a legitimate operation.
  • The security impact is assessed as limited to tag disclosure; the actual sensitivity of 'non-exportable' tags depends on MISP deployment configuration and is not specified in the patch.
  • The availability impact (null report push causing remote save failure) is considered minor and not reflected in the CVSS vector as the primary concern is information disclosure.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 7 11 medium 5
bcp-05-x-03
Vulnerability handling and disclosure timeline
GCVE-BCP-05-X-03
  1. 2026-09-24 14:32 UTC Fix developed Corrective change authored (0be4564a98f37c568a35aa88c5b2bf598a23328a): fix: [sync] Filter the tags of every event report pushed to a
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Event Synchronization"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.\u003c/p\u003e\u003cp\u003eAs a result:\u003c/p\u003e\u003cp\u003e- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.\u003c/p\u003e\u003cp\u003e- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.\u003c/p\u003e\u003cp\u003eThis issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.\n\nAs a result:\n\n- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.\n\n- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.\n\nThis issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.\n\nAffected: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-128",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-128 Leverage Executable Code to Alter Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T08:52:13Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/0be4564a9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable.\u003c/p\u003e"
            }
          ],
          "value": "The non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable."
        }
      ],
      "title": "MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 34 commits after fix), suggesting the fix is included in v2.5.48 and prior versions are affected. No explicit version range is stated in the patch.",
                  "PR:L assumes that a non-admin authenticated user with push-to-remote permissions can trigger the sync; if only administrators can initiate sync, PR should be raised to H.",
                  "The CAPEC-128 mapping is uncertain; no CAPEC pattern precisely describes a per-item filtering logic error causing data leakage during a legitimate operation.",
                  "The security impact is assessed as limited to tag disclosure; the actual sensitivity of \u0027non-exportable\u0027 tags depends on MISP deployment configuration and is not specified in the patch.",
                  "The availability impact (null report push causing remote save failure) is considered minor and not reflected in the CVSS vector as the primary concern is information disclosure."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-128",
                    "rationale": "This is the closest available CAPEC pattern. The vulnerability arises from a code logic error that causes data (non-exportable tags) to be improperly exposed during a legitimate sync operation. The mapping is uncertain because the issue is a logic bug in data filtering rather than a deliberate attacker action; no CAPEC pattern precisely covers \u0027improper per-item filtering in a loop causing data leakage during a legitimate API operation.\u0027"
                  }
                ],
                "commit": "0be4564a98f37c568a35aa88c5b2bf598a23328a",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is triggered over the network during MISP-to-MISP synchronization. AC:L: No special conditions are needed beyond a configured sync relationship and an event with multiple reports. AT:N: No attacker interaction is required; the bug triggers on any sync push. PR:L: An authenticated user with permission to push events to a remote server is required. UI:N: No user interaction beyond initiating the sync. VC:L: Non-exportable tags (restricted metadata) are disclosed to the remote instance; the core event data is not exposed. VI:N, VA:N: No integrity or availability impact on the local instance. SC:N, SI:N, SA:N: No impact on the remote instance\u0027s confidentiality, integrity, or availability beyond receiving the tags it should not have.",
                "fixSummary": "The non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable.",
                "generatedAt": "2026-10-19T08:52:13.881684Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "4195b30bddf42380bf30e617b46cdf8e6a5db388a559dc133f98d401f36c35de",
                "patchSummary": "In app/Model/Event.php, the call to __removeNonExportableTags was moved from a single post-loop invocation (which used the last $key value from the foreach) into the else branch of the loop body, so it executes for each non-empty report individually. The post-loop else block that applied the filter to a single report was removed, eliminating both the tag-leakage bug and the null-report push when the last report was empty.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "0be4564a98f37c568a35aa88c5b2bf598a23328a",
                    "date": "Thu, 24 Sep 2026 16:32:31 +0200",
                    "patchSha256": "4195b30bddf42380bf30e617b46cdf8e6a5db388a559dc133f98d401f36c35de",
                    "source": "https://github.com/MISP/MISP/commit/0be4564a9.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/0be4564a9.patch",
                    "subject": "fix: [sync] Filter the tags of every event report pushed to a"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/0be4564a9.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T08:52:13Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [sync] Filter the tags of every event report pushed to a",
                "tagVersionBoundary": {
                  "commits_after_fix": 34,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-200",
                    "rationale": "Tags explicitly marked as non-exportable were not filtered from event reports during synchronization, exposing restricted information to the remote MISP instance. The root cause is a logic error (filter applied once instead of per-item), but the security consequence is information disclosure."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (0be4564a98f37c568a35aa88c5b2bf598a23328a): fix: [sync] Filter the tags of every event report pushed to a",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/0be4564a9.patch"
                    ],
                    "timestamp": "2026-09-24T14:32:31Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20283"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-112179",
    "datePublished": "2026-10-19T08:53:50.770008Z",
    "dateReserved": "2026-10-19T08:53:56.176Z",
    "dateUpdated": "2026-10-19T08:53:56.252214Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20283"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.