CVE-2026-35211: CWE-94: Improper Control of Generation of Code ('Code Injection') in OpenCTI-Platform opencti
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0.
AI Analysis
Technical Summary
The OpenCTI platform's GraphQL API exposes a script filter operator in its FilterOperator enum that permits authenticated users with the KNOWLEDGE capability to supply Elasticsearch Painless scripts directly into search queries without any validation or sanitization. This improper control of code generation (CWE-94) enables attackers to submit computationally expensive scripts, leading to high CPU consumption on the cluster and potential denial of service for all users. The vulnerability affects all OpenCTI versions prior to 7.260401.0 and has been addressed in that version.
Potential Impact
This vulnerability does not impact confidentiality or integrity but allows denial of service by enabling resource exhaustion through expensive script execution. Attackers with the required privileges can degrade or deny service to all users by consuming excessive CPU resources on the Elasticsearch cluster.
Mitigation Recommendations
Upgrade OpenCTI to version 7.260401.0 or later, where this vulnerability is fixed. No other official remediation or temporary fix is documented. Since this is not a cloud service, users must apply the patch themselves.
CVE-2026-35211: CWE-94: Improper Control of Generation of Code ('Code Injection') in OpenCTI-Platform opencti
Description
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0.
CVSS v3.1
Score 6.5medium
Affected software
pkg:github/opencti-platform/openctiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenCTI platform's GraphQL API exposes a script filter operator in its FilterOperator enum that permits authenticated users with the KNOWLEDGE capability to supply Elasticsearch Painless scripts directly into search queries without any validation or sanitization. This improper control of code generation (CWE-94) enables attackers to submit computationally expensive scripts, leading to high CPU consumption on the cluster and potential denial of service for all users. The vulnerability affects all OpenCTI versions prior to 7.260401.0 and has been addressed in that version.
Potential Impact
This vulnerability does not impact confidentiality or integrity but allows denial of service by enabling resource exhaustion through expensive script execution. Attackers with the required privileges can degrade or deny service to all users by consuming excessive CPU resources on the Elasticsearch cluster.
Mitigation Recommendations
Upgrade OpenCTI to version 7.260401.0 or later, where this vulnerability is fixed. No other official remediation or temporary fix is documented. Since this is not a cloud service, users must apply the patch themselves.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-01T18:48:58.937Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4ebdf5c9d9e3dbe3bf8af4
Added to database: 07/08/2026, 21:15:33 UTC
Last enriched: 07/16/2026, 09:53:12 UTC
Last updated: 08/22/2026, 10:52:08 UTC
Views: 91
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.