Is CVE-2024-37155 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-37155 being exploited in the wild.

How severe is CVE-2024-37155?

Medium severity, with a CVSS score of 6.5, published 22 June 2026.

Which products and versions are affected?

pycti (PyPI) < 6.1.9, ECOSYSTEM:introduced=0,fixed=6.1.9.

Is there a fix for CVE-2024-37155?

Yes. pycti (PyPI): upgrade to 6.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-37155 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2024-37155?

Check whether you run pycti (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-37155: OpenCTI GraphQL introspection restriction bypass

Q: Which products and versions are affected?

pycti (PyPI) < 6.1.9, ECOSYSTEM:introduced=0,fixed=6.1.9.

Q: Is there a fix for CVE-2024-37155?

Yes. pycti (PyPI): upgrade to 6.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-37155 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2024-37155?

Check whether you run pycti (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-37155 · Severity: medium · CVSS 6.5 · Published 2026-06-22

OpenCTI, a platform for managing cyber threat intelligence, contains a flaw that allows users to bypass security restrictions on database queries. By manipulating the formatting of a request, an attacker can gain detailed information about the system's internal structure and capabilities. This information could be used to facilitate unauthorized data access or to launch a denial-of-service attack, potentially disrupting intelligence operations.

Technologies: pycti (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-37155 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-37155 being exploited in the wild.
How severe is CVE-2024-37155?: Medium severity, with a CVSS score of 6.5, published 22 June 2026.
Which products and versions are affected?: pycti (PyPI) < 6.1.9, ECOSYSTEM:introduced=0,fixed=6.1.9.
Is there a fix for CVE-2024-37155?: Yes. pycti (PyPI): upgrade to 6.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-37155 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-37155?: Check whether you run pycti (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pycti (PyPI): upgrade to 6.1.9 or later
```
pip install "pycti>=6.1.9"
```

Technical details

A vulnerability in OpenCTI's 'secureIntrospectionPlugin' allows for the bypass of introspection query restrictions. The root cause is a flawed regex validation that fails to account for GraphQL queries where extra whitespace, carriage returns, and line feed characters have been removed. An unauthenticated remote attacker can exploit this by sending specially crafted, condensed GraphQL queries to the endpoint. Successful exploitation enables schema discovery, which can reveal unauthorized data access paths or be used to conduct Denial of Service (DoS) attacks through repeated complex queries. The issue is addressed in version 6.1.9.

Affected products

Filigran OpenCTI < 6.1.9
Filigran pycti < 6.1.9

Identifiers

CVE-2024-37155
GHSA-4mvw-j8r9-xcgc
PYSEC-2024-313

Timeline

2024-11-18: disclosed: Initial disclosure and NVD publication
2024-11-18: patched: Fix released in version 6.1.9
2026-06-22: advisory: GitHub Advisory published/updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.