# CVE-2026-116469: MISP Guard case-sensitivity bypass in policy enforcement

Source: https://junglewise.ai/threats/cve-2026-116469-misp-guard-a-proxy-based-security-filter-for-misp-malware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116469 · Severity: info · Published 2026-10-26

MISP Guard is a security filter that controls which threat intelligence events are distributed to downstream consumers based on policies like data classification and permitted categories. An attacker with event-creation privileges can bypass these controls by altering the capitalization of taxonomy tags, attribute categories, or sharing-group identifiers, causing restricted data to be forwarded in violation of the organization's distribution policy.

Vendors: [Misp](https://junglewise.ai/threats/vendors/misp).

## Quick answers

**Is CVE-2026-116469 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116469 being exploited in the wild.

**How severe is CVE-2026-116469?** Informational severity, published 26 October 2026.

**Which products and versions are affected?** MISP MISP Guard.

**Is there a fix for CVE-2026-116469?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116469 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116469?** Check whether you run MISP Guard. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a case-sensitivity flaw in policy enforcement functions (check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, check_blocked_analyst_data_sharing_groups_uuids) that perform case-sensitive string comparisons against allow/block lists. An attacker with MISP event-creation privileges can craft events with mismatched capitalization (e.g., 'TLP:AMBER' instead of 'tlp:amber') to evade policy checks and pass restricted events downstream. The fix requires case-insensitive comparison logic in all affected policy enforcement checks.

## Affected products

- MISP MISP Guard

## Related threats

- [MISP Guard taxonomy tag validation bypass](https://junglewise.ai/threats/cve-2026-118173-misp-guard-a-proxy-that-enforces-security-policies-on-misp-feed)