What’s Vulnerable › Vulnerabilities

CVE-2025-26621: OpenCTI vulnerable to Denial of Service through web hook

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-19 · updated 2026-06-17
• Weakness: CWE-94

Description

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype pollution, making the node js server running the OpenCTI frontend become unavailable. Version 6.5.2 fixes the issue.

Affected products

• OpenCTI-Platform opencti: before 6.5.2 — fixed in 6.5.2

How to fix

Upgrade to a fixed version: OpenCTI-Platform opencti 6.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-gq63-jm3h-374p
• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mf88-g2wq-p7qm

Get alerted when CVE-2025-26621 or the next vulnerability affects your stack