PT-2026-25009 · Opencti · Opencti

Daffyspider · Published 2026-03-12 · Updated 2026-03-12 · CVE-2026-21887

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 6.8.16

Description OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. The platform’s data ingestion feature accepts user-supplied URLs without validation and utilizes the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to construct requests to arbitrary endpoints, including internal services, as Axios accepts and processes absolute URLs. This results in a semi-blind Server-Side Request Forgery (SSRF), where responses may not be fully visible but can still impact internal systems. The API endpoint involved in this issue is the data ingestion feature, which accepts URLs via the URL parameter.

Recommendations Versions prior to 6.8.16 should be updated to version 6.8.16 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-21887

GHSA-FFM6-VVPH-G5F5

PYSEC-2026-118

Affected Products

Opencti

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21887.json · Exploit
• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-ffm6-vvph-g5f5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21887 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21887 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-118 · Vendor Advisory
• https://t.me/CVEtracker/47265 · Telegram Post
• https://twitter.com/CVEnew/status/2032230702876377222 · Twitter Post