Threat Intelligence Database

OpenCTI-Platform versions prior to 7.260701.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the synchronizerFetch GraphQL query. This flaw allows authenticated users with the INGESTION capability to make requests to internal services and cloud metadata endpoints without proper restrictions. The vulnerability enables internal network scanning and potential disclosure of internal data. The issue is fixed in version 7.260701.0.

CVE-2026-76821 is a high-severity vulnerability in OpenCTI-Platform's opencti prior to version 7.260706.0. It involves uncontrolled resource consumption due to the JSON ingestion mapper's extractWithRegexp function compiling user-supplied regular expressions without complexity validation. An authenticated user with JSON mapper creation permission can supply a malicious regex causing catastrophic backtracking, blocking the Node.js event loop and making the GraphQL API unavailable. The issue affects availability but does not expose or modify data. The vulnerability is fixed in version 7.260706.0.

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0.

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header, enabling attackers to downgrade confidence levels, remove security markings such as TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports. This issue is fixed in version 7.260326.0.

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable body data. The content of the body field isn't appropriately sanitized when being rendered. Does require user interaction but could be exploited by someone sharing stix or any of the ingester. This could lead to CSRF and then large scale session theft. Version 7.260227.0 contains a fix.

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7.

OpenCTI-Platform versions 6.6.0 through 6.9.12 contain a critical privilege escalation vulnerability (CVE-2026-27960) due to improper authentication. This flaw allows unauthenticated attackers to query the API as any existing user, including the default admin account. The issue is fixed in version 6.9.13. As a temporary mitigation, disabling the default admin account via the APP__ADMIN__EXTERNALLY_MANAGED configuration is recommended.

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform process during notifier template execution. This vulnerability is fixed in 6.9.5.

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports etc. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed. Version 6.9.1 fixes the issue.

MediumVulnerabilityUnited StatesFranceGermany+7#cve#cve-2026-21886#cwe-285

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16.

HighVulnerabilityUnited StatesFranceGermany+7#cve#cve-2026-21887#cwe-918