Vulnerability in OpenCTI Affects Cyber Threat Intelligence Management
CVE-2026-76820

7.7HIGH

Key Information:

Vendor

Opencti-platform

Status
Opencti
Vendor
CVE Published:
15 September 2026

What is CVE-2026-76820?

OpenCTI, an open-source platform designed for managing cyber threat intelligence, is vulnerable due to inadequate validation of remote stream URLs in the synchronizerFetch GraphQL query prior to version 7.260701.0. The backend fails to enforce the ingestion deny list, allowing authenticated users with the INGESTION capability to access internal services and cloud metadata endpoints. This oversight can lead to unauthorized internal network scanning and potential exposure of sensitive data through compatible endpoint responses.

Affected Version(s)

opencti < 7.260701.0

References

https://github.com/OpenCTI-Platform/opencti/security/advi...
x_refsource_CONFIRM
https://github.com/OpenCTI-Platform/opencti/pull/16617
x_refsource_MISC
https://github.com/OpenCTI-Platform/opencti/commit/6c1114...
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.