---
id: CVE-2026-112179
title: MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
summary: >-
  In MISP, the event synchronization process contained a logic error in the
  preparation of event reports for remote push. The filtering of non-exportable
  tags was applied only once after the iteration over all reports, rather than
  to each …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: MISP
product: MISP
affected:
  - MISP < 2.5.48
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:53:57.689Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112179'
references:
  - url: 'https://github.com/MISP/MISP/commit/0be4564a9'
    label: Security patch
tags:
  - cve.org
ingestedAt: '2026-10-19T09:16:01.410Z'
---

## Overview

In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.

As a result:

- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.

- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.

This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.

Affected: <2.5.48.

## Affected

- `MISP < 2.5.48`

## Remediation

The non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable.