MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, TLP), the guard only verified that at least one tag of that taxonomy matched the configured allowed list. It did not verify that every tag of the required taxonomy present on the event or attribute was in the allowed list. As a result, an event or attribute could simultaneously carry an allowed tag (e.g., tlp:clear) and a non-allowed tag (e.g., tlp:red or tlp:amber) and still pass the guard's policy check. This allowed data marked with a higher classification or sensitivity level to be distributed through feeds configured to only distribute lower-classification data, effectively bypassing the intended data-handling restrictions. The vulnerability affected both event-level and attribute-level tag validation, including attributes nested within objects and shadow attributes. An attacker with the ability to author or modify MISP events in a feed source could include non-allowed taxonomy tags alongside allowed ones to exfiltrate more sensitive data to feed consumers than the guard policy intended to permit.
"}],"value":"MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, TLP), the guard only verified that at least one tag of that taxonomy matched the configured allowed list. It did not verify that every tag of the required taxonomy present on the event or attribute was in the allowed list. As a result, an event or attribute could simultaneously carry an allowed tag (e.g., tlp:clear) and a non-allowed tag (e.g., tlp:red or tlp:amber) and still pass the guard's policy check. This allowed data marked with a higher classification or sensitivity level to be distributed through feeds configured to only distribute lower-classification data, effectively bypassing the intended data-handling restrictions. The vulnerability affected both event-level and attribute-level tag validation, including attributes nested within objects and shadow attributes. An attacker with the ability to author or modify MISP events in a feed source could include non-allowed taxonomy tags alongside allowed ones to exfiltrate more sensitive data to feed consumers than the guard policy intended to permit."}],"impacts":[{"capecId":"CAPEC-120","descriptions":[{"lang":"en","value":"CAPEC-120 Parameter Tampering"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.1,"baseSeverity":"MEDIUM","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"SSVC","other":{"content":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-10-27T18:09:46Z","version":"2.0.3"},"type":"SSVC"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-285","description":"CWE-285 Improper Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-27T18:11:51.815Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/misp-guard/commit/6127d94c350e4dfe31fd4426ba26f51294ed3867"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The fix introduces a new validation function, check_required_taxonomy_tags_allowed, that iterates over every tag belonging to a required taxonomy and verifies each one is present in the configured allowed-tags list, raising a ForbiddenException if any tag is not allowed. This check is applied at both the event level and the attribute level. Additionally, an inherit_event_taxonomies flag is introduced so that attributes without their own required-taxonomy tags inherit the event's already-validated taxonomy, while attributes that do carry tags of the required taxonomy are still fully validated against the allowed list. This ensures that no non-allowed tag of a required taxonomy can pass the guard regardless of whether an allowed tag is also present.
"}],"value":"The fix introduces a new validation function, check_required_taxonomy_tags_allowed, that iterates over every tag belonging to a required taxonomy and verifies each one is present in the configured allowed-tags list, raising a ForbiddenException if any tag is not allowed. This check is applied at both the event level and the attribute level. Additionally, an inherit_event_taxonomies flag is introduced so that attributes without their own required-taxonomy tags inherit the event's already-validated taxonomy, while attributes that do carry tags of the required taxonomy are still fully validated against the allowed list. This ensures that no non-allowed tag of a required taxonomy can pass the guard regardless of whether an allowed tag is also present."}],"title":"MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"partial","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The CAPEC-120 mapping is the closest available match but is not a perfect fit; the attack involves manipulation of structured MISP event tag fields rather than traditional HTTP parameters. No more specific CAPEC for structured-data tag manipulation exists in the CAPEC catalog.","The CVSS PR:H assumption is based on the inference that an attacker needs write access to a MISP instance to author events with non-allowed tags. If the guard is deployed in a context where feed sources are fully trusted, the practical exploitability may be lower.","The exact fixed version is not specified in the patch metadata. The tag_version_boundary indicates v1.4 is the nearest tag with 15 commits after the fix, suggesting the fix landed in a version after 1.4, but the precise version number is unknown.","The SI:H rating assumes the data distribution policy violation (higher-TLP data reaching lower-TLP consumers) constitutes a significant integrity impact on the feed's trust model. A different rating (e.g., SI:L) could be argued if the policy is considered advisory rather than binding.","The patch does not specify whether the vulnerability was discovered through a security audit, bug report, or internal testing. No finder or reporter credit is assigned beyond the remediation developer."],"capecRationale":[{"capecId":"CAPEC-120","rationale":"The closest plausible attack pattern is parameter tampering: an attacker who can author MISP feed events manipulates the tag parameters to include a non-allowed taxonomy tag (e.g., tlp:red) alongside an allowed one (e.g., tlp:clear), exploiting the guard's incomplete validation that only checked for the presence of at least one allowed tag. The uncertainty is that this is not a traditional HTTP parameter tampering scenario but rather manipulation of structured data fields (tags) within MISP event objects; however, the fundamental technique of altering input values to bypass validation aligns with CAPEC-120."}],"commit":"6127d94c350e4dfe31fd4426ba26f51294ed3867","confidence":"medium","cpeReview":[{"api":"https://cpe.gcve.eu/api/cpes","cpe":"cpe:2.3:a:misp:misp-guard:*:*:*:*:*:*:*:*","exactSearchTruncated":false,"searchTruncated":false,"status":"not_found"}],"credits":[{"lang":"en","type":"remediation developer","value":"Luciano Righetti"}],"cvssRationale":"AV:N: The vulnerability is exploitable over the network via MISP feed endpoints. AC:L: The attack is straightforward; the attacker simply includes a non-allowed tag alongside an allowed one. AT:N: No need to manipulate or bypass any additional protection. PR:H: The attacker requires high privileges, specifically the ability to author or modify MISP events in a feed source (write access to a MISP instance). UI:N: No user interaction is required. VC:N/VI:N/VA:N: The guard process itself is not compromised in terms of its own confidentiality, integrity, or availability. SC:N: No direct impact on connected systems' confidentiality. SI:H: The integrity of the data distribution policy is significantly violated; data with higher sensitivity/classification is distributed to consumers who should only receive lower-classification data, undermining the trust model of the feed. SA:N: No cascading security impact on other systems.","fixSummary":"The fix introduces a new validation function, check_required_taxonomy_tags_allowed, that iterates over every tag belonging to a required taxonomy and verifies each one is present in the configured allowed-tags list, raising a ForbiddenException if any tag is not allowed. This check is applied at both the event level and the attribute level. Additionally, an inherit_event_taxonomies flag is introduced so that attributes without their own required-taxonomy tags inherit the event's already-validated taxonomy, while attributes that do carry tags of the required taxonomy are still fully validated against the allowed list. This ensures that no non-allowed tag of a required taxonomy can pass the guard regardless of whether an allowed tag is also present.","generatedAt":"2026-10-27T18:09:46.639416Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":11,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":7}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"96c08da8be43b5e5165fc57cebe9904273d91d56fcf14a0566ecd3dfb50ce099","patchSummary":"In src/mispguard.py: (1) Added a new method check_required_taxonomy_tags_allowed that loops over all tags of a required taxonomy and rejects any tag not in the allowed list. (2) Modified check_event_required_taxonomies to call the new method after the existing existence check. (3) Modified check_attribute_required_taxonomies to accept an inherit_event_taxonomies parameter; when True, the existence check is skipped (the event already satisfied it) but the new allowed-tags check still runs on any tags the attribute does hold. (4) Added the inherit_event_taxonomies parameter to check_attribute_level_rules and check_object_level_rules, threading it through recursive calls for ShadowAttribute and object attributes. (5) Updated check_required_taxonomy_exists to accept an entity parameter for clearer error messages. (6) Added 172 lines of test cases in src/test/test_misp_guard.py covering: event with both allowed and non-allowed taxonomy tags (blocked), untagged attribute under a tagged event (allowed), attribute in","patchTruncated":false,"patches":[{"commit":"6127d94c350e4dfe31fd4426ba26f51294ed3867","date":"Mon, 26 Oct 2026 08:44:32 +0100","patchSha256":"96c08da8be43b5e5165fc57cebe9904273d91d56fcf14a0566ecd3dfb50ce099","source":"https://github.com/MISP/misp-guard/commit/6127d94c350e4dfe31fd4426ba26f51294ed3867.patch","sourceUrl":"https://github.com/MISP/misp-guard/commit/6127d94c350e4dfe31fd4426ba26f51294ed3867.patch","subject":"fix: [security] enforce allowed tags on every tag of a"}],"source":"https://github.com/MISP/misp-guard/commit/6127d94c350e4dfe31fd4426ba26f51294ed3867.patch","ssvc":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-10-27T18:09:46Z","version":"2.0.3"},"subject":"fix: [security] enforce allowed tags on every tag of a","tagVersionBoundary":{"commits_after_fix":15,"repository":"https://github.com/MISP/misp-guard","tag":"v1.4","version":"1.4","version_type":"custom"},"weaknessRationale":[{"cweId":"CWE-20","rationale":"The guard's validation logic for required taxonomy tags was incomplete: it only checked for the existence of at least one allowed tag rather than verifying that all tags of the required taxonomy were in the allowed list. This is a classic incomplete input validation flaw where the check does not cover all relevant input values."},{"cweId":"CWE-285","rationale":"The guard's purpose is to enforce authorization policies on data flowing through MISP feeds. The incomplete tag check effectively allowed unauthorized (non-allowed) tags to pass, resulting in improper enforcement of the data distribution authorization policy."}]}},"bcp-05-x-03":{"x_timeline":{"events":[{"description":"Corrective change authored (6127d94c350e4dfe31fd4426ba26f51294ed3867): fix: [security] enforce allowed tags on every tag of a","id":"evt-fix-developed-1","references":["https://github.com/MISP/misp-guard/commit/6127d94c350e4dfe31fd4426ba26f51294ed3867.patch"],"timestamp":"2026-10-26T07:44:32Z","type":"fix-developed"}]}}},"recordType":"advisory","vulnId":"gcve-1-2026-20219"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-118173","datePublished":"2026-10-27T18:11:51.815Z","dateReserved":"2026-10-27T18:11:43.078Z","dateUpdated":"2026-10-27T18:11:51.815Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-27 19:17:28","lastModifiedDate":"2026-10-27 19:17:28","problem_types":["CWE-20","CWE-285","CWE-20 CWE-20 Improper Input Validation","CWE-285 CWE-285 Improper Authorization"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"timestamp":"2026-10-27T18:09:46Z","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"Supplier","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"118173","Ordinal":"1","Title":"MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy","CVE":"CVE-2026-118173","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"118173","Ordinal":"1","NoteData":"MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, TLP), the guard only verified that at least one tag of that taxonomy matched the configured allowed list. It did not verify that every tag of the required taxonomy present on the event or attribute was in the allowed list. As a result, an event or attribute could simultaneously carry an allowed tag (e.g., tlp:clear) and a non-allowed tag (e.g., tlp:red or tlp:amber) and still pass the guard's policy check. This allowed data marked with a higher classification or sensitivity level to be distributed through feeds configured to only distribute lower-classification data, effectively bypassing the intended data-handling restrictions. The vulnerability affected both event-level and attribute-level tag validation, including attributes nested within objects and shadow attributes. An attacker with the ability to author or modify MISP events in a feed source could include non-allowed taxonomy tags alongside allowed ones to exfiltrate more sensitive data to feed consumers than the guard policy intended to permit.","Type":"Description","Title":"MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy"}]}}}