Incomplete Validation in MISP Guard Proxy for MISP Feed Data by MISP

CVE-2026-118173

What is CVE-2026-118173?

MISP Guard, a critical proxy service for enforcing security policies on MISP feed data, has a vulnerability due to incomplete validation of taxonomy tags. The service only checks that at least one tag from a required taxonomy matches a configured allowed list, neglecting to ensure that all tags from that taxonomy are valid. This oversight means that events or attributes can include both allowed and disallowed tags, enabling attackers to sneak in higher sensitivity data alongside lower classification data. Such a flaw compromises the guard's intended data handling, permitting unauthorized data to flow to consumers in situations where strict filtering is required. This affects both event-level and attribute-level tag validations.

References