Is CVE-2026-118173 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118173 being exploited in the wild.

How severe is CVE-2026-118173?

Informational severity, published 27 October 2026.

Is there a fix for CVE-2026-118173?

A patch was published on 2026-10-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118173 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-118173?

Check whether you run MISP Guard. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118173: MISP Guard taxonomy tag validation bypass

CVE-2026-118173 · Severity: info · Published 2026-10-27

MISP Guard is a proxy that enforces data-handling security policies on MISP threat intelligence feeds. A validation bug allowed events to carry both allowed and forbidden taxonomy tags (such as TLP classifications) simultaneously, permitting sensitive data marked with higher classification levels to be distributed through feeds configured to permit only lower classifications. An attacker who can modify events in a feed source could exploit this to exfiltrate more sensitive threat data than intended.

Vendors: Misp.

Quick answers

Is CVE-2026-118173 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118173 being exploited in the wild.
How severe is CVE-2026-118173?: Informational severity, published 27 October 2026.
Which products and versions are affected?: MISP MISP Guard.
Is there a fix for CVE-2026-118173?: A patch was published on 2026-10-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118173 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-118173?: Check whether you run MISP Guard. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incomplete validation flaw in taxonomy tag enforcement at the event, attribute, and object levels. The guard checked only that at least one tag from a required taxonomy matched the allowed list, rather than validating that every tag of that taxonomy was allowed. This affects attributes nested within objects and shadow attributes, and requires an attacker with the ability to author or modify MISP events in a feed source.

Affected products

MISP MISP Guard

Timeline

2026-10-27: disclosed
2026-10-26: patched

References

https://github.com/MISP/misp-guard/commit/6127d94c350e4dfe31fd4426ba26f51294ed3867

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.