EUVD-2026-42431Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable GraphQL API requires low-privilege authenticated KNOWLEDGE role; pure availability impact via CPU exhaustion with no confidentiality or integrity impact confirmed.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0.
AnalysisAI
Elasticsearch Painless script injection via OpenCTI's GraphQL API allows any authenticated user holding the KNOWLEDGE capability to submit computationally expensive, unvalidated scripts that saturate Elasticsearch cluster CPU, degrading or denying service for the entire platform. All OpenCTI deployments prior to version 7.260401.0 are affected, with the vulnerability residing in the exposed 'script' FilterOperator of the GraphQL API. No public exploit code or CISA KEV listing is confirmed at time of analysis; a vendor-released patch is available in version 7.260401.0.
Technical ContextAI
OpenCTI is an open-source cyber threat intelligence management platform backed by Elasticsearch for knowledge graph storage and search. Its GraphQL API exposes a FilterOperator enum that includes a 'script' operator, which accepts user-supplied Elasticsearch Painless script strings and forwards them directly into Elasticsearch search queries without any input validation or sanitization. Painless is Elasticsearch's native sandboxed scripting language designed to prevent host-level code execution; however, it permits arbitrarily complex computations - heavy loops, nested aggregations - that can monopolize Elasticsearch cluster CPU threads and starve all concurrent queries. CWE-94 (Improper Control of Generation of Code / Code Injection) captures the root cause: user-controlled input is embedded directly into an executable scripting context without neutralization. The CVSS impact profile (C:N/I:N/A:H) is consistent with Painless sandbox containment - the confirmed exploitable impact is availability degradation, not data exfiltration or OS-level command execution. The 'RCE' tag in the source intelligence data reflects the CWE-94 injection class and should not be treated as confirmed remote code execution absent further evidence.
RemediationAI
Upgrade to OpenCTI version 7.260401.0, the vendor-confirmed fix, available at https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260401.0. The specific fix is implemented in pull request https://github.com/OpenCTI-Platform/opencti/pull/15284 and commit https://github.com/OpenCTI-Platform/opencti/commit/b134ccedf9e68386723cb42197f8e1d60c3bdbd9. If immediate upgrade is not feasible, restrict the KNOWLEDGE capability to the minimum set of trusted user accounts via OpenCTI's RBAC configuration, reducing the attack surface to highly trusted identities only - this trade-off limits self-service threat intelligence querying for regular analysts. Additionally, configuring Elasticsearch cluster-level script circuit breakers (e.g., CPU time and memory limits for Painless execution via Elasticsearch's scripting resource controls) may reduce blast radius but does not eliminate the injection path and may degrade legitimate complex search functionality.
OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can
Unauthenticated attackers can escalate privileges in OpenCTI 6.6.0-6.9.12 by impersonating any user account, including t
OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can
OpenCTI is an open cyber threat intelligence (CTI) platform. Rated critical severity (CVSS 9.1), this vulnerability is r
Server-Side Template Injection in OpenCTI notifier templates allows privileged administrators with 'Manage customization
OpenCTI is an open-source cyber threat intelligence platform. Rated high severity (CVSS 8.1), this vulnerability is remo
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observ
In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. Rated high
Privilege escalation in OpenCTI prior to 6.9.7 allows an organization admin to gain elevated platform-wide privileges by
Authorization bypass in OpenCTI prior to version 7.260326.0 lets any authenticated user holding the KNOWLEDGE_KNUPDATE p
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.
OpenCTI versions prior to 6.9.1 contain an authorization bypass vulnerability in the GraphQL mutation 'IndividualDeletio
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today