Executive brief
OpenCTI is an open-source threat intelligence platform used to organize and manage cyber security data. Prior to version 7.260701.0, authenticated users with ingestion permissions could bypass network access controls and make the platform request internal services and cloud metadata endpoints, potentially exposing sensitive infrastructure information or internal configurations. The vulnerability also allows attackers to scan internal networks by observing connection error responses.
Technical details
The synchronizerFetch GraphQL query in OpenCTI's fetchRemoteStreams function validated remote stream URLs only for HTTP/HTTPS protocol, but failed to enforce the ingestion deny list or reject private/loopback/link-local IP addresses. An authenticated user with the INGESTION capability could supply a malicious URL pointing to internal services or cloud metadata endpoints; the backend would attempt to fetch it and return detailed connection error responses that leak network topology information. This enables both internal network scanning (distinguishing open HTTP ports, open non-HTTP ports, and closed ports) and potential data disclosure from compatible endpoints. The fix in version 7.260701.0 implements URI validation on the backend to enforce the deny list and reject restricted address ranges.
Affected products
- OpenCTI Platform OpenCTI before 7.260701.0
Timeline
- 2026-09-15: disclosed
- 2026-06-30: patched: Fix merged; version 7.260701.0 released