CVE-2026-107278
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-20
Validación incorrecta de entrada
Fecha de publicación:
07/10/2026
Última modificación:
07/10/2026
Descripción
*** Pendiente de traducción *** MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance&#39;s validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.<br />
<br />
Preconditions:<br />
<br />
- Two or more MISP instances are configured to synchronize objects.<br />
<br />
- A user with object-creation privileges creates an object without supplying a description.<br />
<br />
- The object is subsequently synced to a peer instance.<br />
<br />
Impact:<br />
<br />
- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.<br />
<br />
- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.<br />
<br />
Affected:
Impacto
Puntuación base 4.0
5.30
Gravedad 4.0
MEDIA