Is CVE-2026-76820 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76820 being exploited in the wild.

How severe is CVE-2026-76820?

High severity, with a CVSS score of 7.7, published 15 September 2026.

Which products and versions are affected?

OpenCTI Platform OpenCTI before 7.260701.0.

Is there a fix for CVE-2026-76820?

A patch was published on 2026-06-30: Fix merged; version 7.260701.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76820 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-76820?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76820: OpenCTI unauthorized internal network access via fetchRemoteStreams

CVE-2026-76820 · Severity: high · CVSS 7.7 · Published 2026-09-15

OpenCTI is an open-source threat intelligence platform used to organize and manage cyber security data. Prior to version 7.260701.0, authenticated users with ingestion permissions could bypass network access controls and make the platform request internal services and cloud metadata endpoints, potentially exposing sensitive infrastructure information or internal configurations. The vulnerability also allows attackers to scan internal networks by observing connection error responses.

Quick answers

Is CVE-2026-76820 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76820 being exploited in the wild.
How severe is CVE-2026-76820?: High severity, with a CVSS score of 7.7, published 15 September 2026.
Which products and versions are affected?: OpenCTI Platform OpenCTI before 7.260701.0.
Is there a fix for CVE-2026-76820?: A patch was published on 2026-06-30: Fix merged; version 7.260701.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76820 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-76820?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The synchronizerFetch GraphQL query in OpenCTI's fetchRemoteStreams function validated remote stream URLs only for HTTP/HTTPS protocol, but failed to enforce the ingestion deny list or reject private/loopback/link-local IP addresses. An authenticated user with the INGESTION capability could supply a malicious URL pointing to internal services or cloud metadata endpoints; the backend would attempt to fetch it and return detailed connection error responses that leak network topology information. This enables both internal network scanning (distinguishing open HTTP ports, open non-HTTP ports, and closed ports) and potential data disclosure from compatible endpoints. The fix in version 7.260701.0 implements URI validation on the backend to enforce the deny list and reject restricted address ranges.

Affected products

OpenCTI Platform OpenCTI before 7.260701.0

Timeline

2026-09-15: disclosed
2026-06-30: patched: Fix merged; version 7.260701.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.