CVE-2026-76820: CWE-918: Server-Side Request Forgery (SSRF) in OpenCTI-Platform opencti
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.
AI Analysis
Technical Summary
OpenCTI-Platform's opencti product versions before 7.260701.0 contain an SSRF vulnerability in the synchronizerFetch GraphQL query. The query calls fetchRemoteStreams after only verifying that the remote stream URL uses HTTP or HTTPS, but it does not enforce the ingestion deny list or block requests to private, loopback, or link-local addresses. An authenticated user with the INGESTION capability can exploit this to make the backend send requests to internal network services and cloud metadata endpoints. This allows distinguishing open HTTP and non-HTTP ports and closed ports, facilitating internal network scanning. Additionally, responses from compatible endpoints may disclose internal data. The vulnerability is resolved in version 7.260701.0.
Potential Impact
An authenticated user with the INGESTION capability can perform SSRF attacks that enable internal network reconnaissance and potential data disclosure from internal services and cloud metadata endpoints. This could lead to exposure of sensitive internal information. The vulnerability does not allow direct integrity or availability impact but has a high confidentiality impact.
Mitigation Recommendations
This vulnerability is fixed in OpenCTI-Platform opencti version 7.260701.0. Users should upgrade to this version or later to remediate the issue. No additional mitigation is required if the fix is applied.
CVE-2026-76820: CWE-918: Server-Side Request Forgery (SSRF) in OpenCTI-Platform opencti
Description
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.
CVSS v3.1
Score 7.7high
Affected software
OpenCTI-Platform
opencti
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenCTI-Platform's opencti product versions before 7.260701.0 contain an SSRF vulnerability in the synchronizerFetch GraphQL query. The query calls fetchRemoteStreams after only verifying that the remote stream URL uses HTTP or HTTPS, but it does not enforce the ingestion deny list or block requests to private, loopback, or link-local addresses. An authenticated user with the INGESTION capability can exploit this to make the backend send requests to internal network services and cloud metadata endpoints. This allows distinguishing open HTTP and non-HTTP ports and closed ports, facilitating internal network scanning. Additionally, responses from compatible endpoints may disclose internal data. The vulnerability is resolved in version 7.260701.0.
Potential Impact
An authenticated user with the INGESTION capability can perform SSRF attacks that enable internal network reconnaissance and potential data disclosure from internal services and cloud metadata endpoints. This could lead to exposure of sensitive internal information. The vulnerability does not allow direct integrity or availability impact but has a high confidentiality impact.
Mitigation Recommendations
This vulnerability is fixed in OpenCTI-Platform opencti version 7.260701.0. Users should upgrade to this version or later to remediate the issue. No additional mitigation is required if the fix is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-19T19:52:28.214Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa9a0bd55bf5e2cf54b8f08
Added to database: 09/15/2026, 19:47:09 UTC
Last enriched: 09/15/2026, 20:01:49 UTC
Last updated: 09/16/2026, 03:15:27 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.