What’s Vulnerable › Vulnerabilities

CVE-2026-35211: OpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoS

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-10-25
• Weakness: CWE-94

Description

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0.

Affected products

• OpenCTI-Platform opencti: before 7.260401.0 — fixed in 7.260401.0

How to fix

Upgrade to a fixed version: OpenCTI-Platform opencti 7.260401.0. Check the vendor advisory for mitigations.

References

• https://github.com/OpenCTI-Platform/opencti/commit/b134ccedf9e68386723cb42197f8e1d60c3bdbd9
• https://github.com/OpenCTI-Platform/opencti/pull/15284
• https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260401.0
• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-qpp6-p693-rmm4

Get alerted when CVE-2026-35211 or the next vulnerability affects your stack