Quick answers
- Is CVE-2026-116372 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116372 being exploited in the wild.
- How severe is CVE-2026-116372?
- Informational severity, published 26 October 2026.
- Which products and versions are affected?
- MISP mispguard.
- Is there a fix for CVE-2026-116372?
- Yes: fixed in mispguard commit b5f606a4e57a49cc4dbf9b3ef0c6ddd19f866735 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116372 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-116372?
- Check whether you run Mispguard. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: mispguard commit b5f606a4e57a49cc4dbf9b3ef0c6ddd19f866735 or later
Technical details
The process_feed_response method in src/mispguard.py only explicitly filtered responses with non-200 status codes, assuming non-200 responses would not be ingested. However, other 2xx status codes (201, 203, 206) are still processed by MISP and bypassed the filtering logic. An attacker controlling or compromising a configured feed endpoint can return a 2xx response other than 200 with malicious content, effectively bypassing mispguard's security rules.
Affected products
- MISP mispguard
Timeline
- 2026-10-26: disclosed
- 2026-10-26: patched: Commit b5f606a