MISP EUVD-2026-104128

Requires a MISP instance explicitly configured to push events to a remote server via synchronization, AND affected events must contain multiple event reports where at least one carries non-exportable (restricted) tags. The bug only manifests across a multi-report set: the tag-filtering routine runs once after iterating all reports instead of per report, so only the final report is correctly sanitized. Limiting factors: an authenticated/trusted sync relationship must already exist (PR:L), disclosure is confined to instances the operator already pushes to, single-report events are unaffected, and no external unauthenticated access to the vulnerable host is involved.

This is a genuine but low-severity confidentiality issue, not an urgent priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) and the 5.3 base score are internally consistent with the description: exploitation occurs over the network within an already-established, authenticated MISP synchronization relationship (PR:L), requires no user interaction, has low attack complexity, and yields only low-impact confidentiality loss (leakage of non-exportable tag metadata, CWE-200). No EPSS score, KEV listing, or public exploit was provided; exploitation status is therefore 'no public exploit identified at time of analysis.' Critically, this is not a classic adversarial exploit - the disclosure happens automatically as a side effect of a logic error during normal sync operations, so the real-world 'attacker' is effectively the trusted but unintended receiving instance rather than an external actor. The signals do not conflict, but note that the disclosure is bounded to MISP instances the victim already chose to push to, which substantially limits real-world risk below what a raw network-vector reading might suggest. The secondary effect (a null last report causing the remote instance to fail saving the event) is a minor availability/integrity annoyance on the receiving side, not reflected in the vendor's VI:N/VA:N scoring.

A MISP instance is configured to synchronize events to a remote (e.g. partner or community) server, and an event contains multiple event reports where some carry non-exportable/restricted tags. During the push, every report except the last retains its restricted tags, silently disclosing that restricted tag information to the receiving instance; if the last report is withheld, a null report is pushed and the remote fails to save the event. No public exploit code exists - the only source artifact is the upstream fix commit.