CVE-2026-76820

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/OpenCTI-Platform/opencti/commit/6c1114ce8ce8f3a9d9b8c82dfff3a3a462e5dc1f
https://github.com/OpenCTI-Platform/opencti/pull/16617
https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260701.0
https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-f6pj-3m32-q934

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-15 20:17

Updated : 2026-09-15 20:17

NVD link : CVE-2026-76820

Mitre link : CVE-2026-76820

CVE.ORG link : CVE-2026-76820

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-76820", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OpenCTI-Platform", "product": "opencti", "versions": [{"status": "affected", "version": "< 7.260701.0"}]}]}], "published": "2026-09-15T20:17:57.127", "references": [{"url": "https://github.com/OpenCTI-Platform/opencti/commit/6c1114ce8ce8f3a9d9b8c82dfff3a3a462e5dc1f", "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenCTI-Platform/opencti/pull/16617", "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260701.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-f6pj-3m32-q934", "source": "security-advisories@github.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0."}], "lastModified": "2026-09-15T20:17:57.127", "sourceIdentifier": "security-advisories@github.com"}