What is the CVSS score of CVE-2026-21887?

CVE-2026-21887 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of OpenCTI are affected by CVE-2026-21887?

OpenCTI instances are vulnerable to Server-Side Request Forgery (SSRF) attacks that could allow threat actors to access internal services and sensitive data without authentication.. A patch is available.

How to fix or mitigate CVE-2026-21887?

Within 24 hours: Disable the data ingestion feature in OpenCTI or restrict access to trusted administrators only; audit recent ingestion logs for suspicious URLs. Within 7 days: Implement network segmentation to isolate OpenCTI from internal services and deploy WAF rules blocking requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1/8) from the OpenCTI application. Within 30 days: Monitor vendor advisories for patch CVE-2026-21887; plan upgrade to version 6.8.16 or later immediately upon release.

OpenCTI CVE-2026-21887

EUVD-2026-11599 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-12 security-advisories@github.com

GHSA-ffm6-vvph-g5f5 PYSEC-2026-118

SSRF

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 17:16 nvd

HIGH 7.7

DescriptionGitHub Advisory

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16.

AnalysisAI

OpenCTI versions prior to 6.8.16 contain a server-side request forgery vulnerability in the data ingestion feature that fails to validate user-supplied URLs, allowing authenticated attackers to send requests to arbitrary internal endpoints and services. The Axios HTTP client's permissive default configuration processes absolute URLs without restriction, enabling semi-blind SSRF attacks that can compromise internal systems despite limited response visibility. This vulnerability requires authentication but affects all deployments running vulnerable versions.

Technical ContextAI

This vulnerability (CWE-918: Server-Side Request Forgery (SSRF)) affects OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.. OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not