MISP Guard CVE-2026-116469

Exploitation requires (1) a deployed MISP Guard instance acting as the feed-distribution proxy, (2) the operator having configured policies that rely on the affected checks - required-taxonomy enforcement, allowed-tag lists (e.g. tlp allowing only tlp:clear), blocked attribute categories, or blocked sharing-group UUIDs - and (3) the attacker possessing normal MISP event-creation/modification privileges on the guarded instance or on an upstream instance that pushes events through the guard (PR:L, not anonymous). The sole technical trigger is altering the letter case of a taxonomy tag, attribute category, or sharing-group UUID string so it no longer matches the case-sensitive policy entry. Limiting factors: the bypass yields confidentiality impact only (unauthorized data forwarding), not integrity or availability; it is ineffective where no such allow/block policies are configured; and it affects only versions ≤1.3.

This is a genuine but bounded confidentiality risk rather than an urgent emergency, and the signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) indicates a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high confidentiality impact and no integrity or availability impact - matching a policy-bypass that leaks restricted threat intel. CWE-178 (improper handling of case sensitivity) and the vendor commit confirm the mechanism precisely: four enforcement functions used case-sensitive comparisons, now fixed with .lower() normalization. There is NO CISA KEV listing and NO EPSS score supplied, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_week', consistent with a real but non-emergency priority. The input provides a vendor patch commit and its accompanying regression tests, but NO dedicated proof-of-concept or exploit reference - so this should not be treated as having public exploit code. PR:L is appropriate: exploitation requires the ability to create or modify events in a MISP instance (or an upstream instance that pushes through the guard), not anonymous access. The net picture is a trivially-simple-to-trigger but privilege-gated and deployment-specific confidentiality bypass affecting a niche product - a legitimate 'patch this week' item, not a drop-everything emergency.

An analyst or a compromised/malicious upstream MISP instance with normal event-creation rights crafts an event whose TLP taxonomy tag, attribute category, or sharing-group UUID differs only in letter case from the operator's configured allow/block list (e.g. 'TLP:AMBER' instead of 'tlp:amber', or category 'Person' instead of 'person'). Because MISP Guard compared these strings case-sensitively, the event is not recognized as matching the policy and is forwarded to downstream feed consumers in violation of the intended distribution restriction. No public exploit code is provided; the vendor commit and its regression tests demonstrate the trigger.