# CVE-2026-116372: MISP mispguard HTTP status code bypass in feed filtering

Source: https://junglewise.ai/threats/cve-2026-116372-misp-mispguard-is-a-security-filtering-proxy-that-inspects-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116372 · Severity: info · Published 2026-10-26

MISP mispguard is a security filter that inspects feed data before it reaches a MISP threat intelligence platform. The filter incorrectly passes through HTTP responses with 2xx status codes other than 200 (such as 203 or 206) without inspection, allowing a malicious feed source to inject unfiltered or malicious content into MISP and bypass security controls.

Vendors: [Misp](https://junglewise.ai/threats/vendors/misp).

## Quick answers

**Is CVE-2026-116372 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116372 being exploited in the wild.

**How severe is CVE-2026-116372?** Informational severity, published 26 October 2026.

**Which products and versions are affected?** MISP mispguard.

**Is there a fix for CVE-2026-116372?** Yes: fixed in mispguard commit b5f606a4e57a49cc4dbf9b3ef0c6ddd19f866735 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116372 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116372?** Check whether you run Mispguard. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in mispguard commit b5f606a4e57a49cc4dbf9b3ef0c6ddd19f866735 or later

## Technical details

The process_feed_response method in src/mispguard.py only explicitly filtered responses with non-200 status codes, assuming non-200 responses would not be ingested. However, other 2xx status codes (201, 203, 206) are still processed by MISP and bypassed the filtering logic. An attacker controlling or compromising a configured feed endpoint can return a 2xx response other than 200 with malicious content, effectively bypassing mispguard's security rules.

## Affected products

- MISP mispguard

## Timeline

- 2026-10-26: disclosed
- 2026-10-26: patched: Commit b5f606a

## References

- [https://github.com/MISP/misp-guard/commit/b5f606a4e57a49cc4dbf9b3ef0c6ddd19f866735](https://github.com/MISP/misp-guard/commit/b5f606a4e57a49cc4dbf9b3ef0c6ddd19f866735)