Read the docs
TI-2026-53664 Aliases CVE-2026-76820

OpenCTI: Synchronizer SSRF: stream fetch has no URL validation

Priority LOW 34CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed opencti (OpenCTI-Platform): 7.260701.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenCTI-Platformopenctibefore 7.260701.07.260701.0Patch availableCNA
  • opencti VendorOpenCTI-Platform Affected before 7.260701.0 Fixed in 7.260701.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:citeum:opencti:*:*:*:*:*:*:*:*——OpenCTI-Platform

Remediation

  • Fix · CNA opencti (OpenCTI-Platform) Fixed in 7.260701.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76820

References

Other 4

  • TI-2024-24682 OpenCTI May Bypass Introspection Restriction CVSS 3.1HIGH 8.2
  • TI-2024-30453 OpenCTI's lack of Rate Limit lead to OTP brute forcing CVSS 3.1HIGH 8.1
  • TI-2020-19176 OpenCTI 3.3.1 - Directory Traversal CVSS 4.0HIGH 7.1
  • TI-2026-22303 OpenCTI privilege escalation and unauthenticated access via default admin account CVSS 3.1CRITICAL 9.8
  • TI-2020-19179 OpenCTI 3.3.1 - Cross Site Scripting CVSS 4.0MEDIUM 5.1
  • TI-2024-30771 OpenCTI leaks support information due to inadequate access control CVSS 3.1MEDIUM 4.3
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences