{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-116469 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-116469 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-116469 is a high-severity vulnerability in misp-guard, published on 26 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-116469 and fix it if it is affected.\n\nWhat it is: CVE-2026-116469 is a high-severity vulnerability in misp-guard, published on 26 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-116469 in the wild and no public exploit code.\n\nAffected product: misp-guard. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-116469/ (Markdown: https://insights.sbomify.com/CVE-2026-116469/index.md)","id":"CVE-2026-116469","markdown":"https://insights.sbomify.com/CVE-2026-116469/index.md","name":"CVE-2026-116469","record":{"aliases":["GHSA-xwff-xxvq-7fgx"],"analysis":null,"analysis_generated_by":null,"assigner":"CIRCL","cpe":[],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-178","name":"Improper Handling of Case Sensitivity"}],"description":"MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.\n\nAn attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter.\n\nThe security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce.\n\nThe vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding","id":"CVE-2026-116469","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"BKWLD Decoy Authorization Policy Policy.php privileges management","id":"CVE-2026-116471"},"packages":[],"prev":{"headline":"ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion","id":"CVE-2026-116467"},"products":["misp-guard"],"published":"2026-10-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-27","vendors":["MISP"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-116469/"}