CVE-2026-35211

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenCTI-Platform/opencti/commit/b134ccedf9e68386723cb42197f8e1d60c3bdbd9	Patch
https://github.com/OpenCTI-Platform/opencti/pull/15284	Issue Tracking Patch
https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260401.0	Release Notes
https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-qpp6-p693-rmm4	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:citeum:opencti:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-07-08 21:16

Updated : 2026-07-13 14:48

NVD link : CVE-2026-35211

Mitre link : CVE-2026-35211

CVE.ORG link : CVE-2026-35211

JSON object : View

Products Affected

citeum

opencti

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-863

Incorrect Authorization

{"id": "CVE-2026-35211", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35211", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T14:45:58.349167Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OpenCTI-Platform", "product": "opencti", "versions": [{"status": "affected", "version": "< 7.260401.0"}]}]}], "published": "2026-07-08T21:16:48.630", "references": [{"url": "https://github.com/OpenCTI-Platform/opencti/commit/b134ccedf9e68386723cb42197f8e1d60c3bdbd9", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenCTI-Platform/opencti/pull/15284", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260401.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-qpp6-p693-rmm4", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0."}], "lastModified": "2026-07-13T14:48:33.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:citeum:opencti:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3890BF2D-1F6D-46BC-9217-5823DBE90085", "versionEndExcluding": "7.260401.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}