TI-2025-19558 Aliases CVE-2025-26621

OpenCTI vulnerable to Denial of Service through web hook

LOW 34CWE-94Published 2025-05-19 · Updated 2025-05-19

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: None · Low · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype pollution, making the node js server running the OpenCTI frontend become unavailable. Version 6.5.2 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0042 36th percentileScored 2026-11-07

Fix Fixed opencti (OpenCTI-Platform): 6.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenCTI-Platform	opencti	before 6.5.2	6.5.2	Patch available	CNA

opencti VendorOpenCTI-Platform Affected before 6.5.2 Fixed in 6.5.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:citeum:opencti::::::::	before 6.5.2	Vulnerable	OpenCTI-Platform

cpe:2.3:a:citeum:opencti:*:*:*:*:*:*:*:* Versions before 6.5.2 Vulnerable ·OpenCTI-Platform

Remediation

Fix · CNA opencti (OpenCTI-Platform) Fixed in 6.5.2

Timeline

2026-10-02 Threatist record created from CVE-2025-26621

References

Advisory 1

https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-gq63-jm3h-374p

Other 1

https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mf88-g2wq-p7qm

TI-2024-24682 OpenCTI May Bypass Introspection Restriction CVSS 3.1HIGH 8.2
TI-2024-30453 OpenCTI's lack of Rate Limit lead to OTP brute forcing CVSS 3.1HIGH 8.1
TI-2020-19176 OpenCTI 3.3.1 - Directory Traversal CVSS 4.0HIGH 7.1
TI-2026-22303 OpenCTI privilege escalation and unauthenticated access via default admin account CVSS 3.1CRITICAL 9.8
TI-2020-19179 OpenCTI 3.3.1 - Cross Site Scripting CVSS 4.0MEDIUM 5.1
TI-2024-30771 OpenCTI leaks support information due to inadequate access control CVSS 3.1MEDIUM 4.3

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences