CVE-2026-116372 MISP CVE debrief

Who should care

Defenders and security teams responsible for MISP instances and feed endpoint configurations should assess exposure and prioritize verification and remediation efforts. Roles responsible for MISP instance and feed endpoint configuration should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should care about CVE-2026-116372 as it allows potentially malicious or unfiltered feed data to be ingested into the MISP instance, undermining security controls. Roles responsible for MISP instance and feed endpoint configuration should assess exposure and prioritize verification and remediation efforts. The vulnerability requires control or compromise of a feed endpoint configured in the MISP instance. Evidence is limited, and additional information on affected versions, exploitation, and remediation is needed.

• Potential ingestion of unfiltered or malicious feed data into the MISP instance
• Bypassing of mispguard filtering rules
• Possible compromise of MISP instance security controls

Technical summary

The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. However, the original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering. This allowed unfiltered or malicious feed data to be ingested into the MISP instance. The vulnerability requires control or compromise of a feed endpoint configured in the MISP instance. Evidence is limited, and additional information on affected versions, exploitation, and remediation is needed.

Defensive priority

Defenders should prioritize verifying and updating mispguard configurations, reviewing feed endpoints, and ensuring proper filtering rules are in place.

Recommended defensive actions

• Verify and update mispguard configurations to ensure proper filtering rules are in place
• Review and secure feed endpoints configured in the MISP instance
• Monitor MISP instance for potential malicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, additional information on affected versions, exploitation, and remediation is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.