EUVD-2026-34035Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable body data. The content of the body field isn't appropriately sanitized when being rendered. Does require user interaction but could be exploited by someone sharing stix or any of the ingester. This could lead to CSRF and then large scale session theft. Version 7.260227.0 contains a fix.
AnalysisAI
Stored cross-site scripting in OpenCTI's email-message observable rendering allows an unauthenticated attacker to inject malicious script payloads via STIX data sharing or platform ingesters, which then execute in the browsers of authenticated users who view the affected observable. Versions prior to 7.260227.0 are affected; the body field of email-message observables is passed to the renderer without sanitization. Successful exploitation can chain into CSRF attacks and large-scale session token theft across the user base. No public exploit or CISA KEV listing exists at time of analysis; vendor-released patch is available.
Technical ContextAI
OpenCTI (cpe:2.3:a:opencti-platform:opencti:*:*:*:*:*:*:*:*) is an open-source cyber threat intelligence platform that ingests and renders Structured Threat Information eXpression (STIX) objects, including email-message observables. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to sanitize or encode the 'body' field of email-message STIX objects before rendering them in the platform's frontend. Because OpenCTI accepts STIX data from external sharing partners and automated ingesters, attacker-controlled content can enter the platform without requiring direct platform authentication, making the injection surface broader than a typical authenticated stored-XSS scenario. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms network-reachable injection with no attack prerequisites and no privilege requirement, but passive user interaction (a legitimate user viewing the rendered observable) is required for the payload to fire.
RemediationAI
Upgrade to OpenCTI version 7.260227.0, which contains the vendor-released fix per the GitHub security advisory GHSA-rg6r-x26x-63vq (https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-rg6r-x26x-63vq). If immediate upgrade is not possible, a prioritized compensating control is to restrict or temporarily disable STIX ingestion from untrusted external sources and sharing partnerships - this removes the unauthenticated injection vector, though it disrupts threat intelligence feed ingestion. A secondary control is to enforce a Content Security Policy (CSP) header at the reverse proxy or load balancer level that disallows inline script execution; note this may break legitimate platform UI functionality and requires testing before deployment. Reviewing and auditing existing email-message observables already ingested for suspicious body content is also advisable, as malicious payloads may already be stored prior to patching.
OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can
Unauthenticated attackers can escalate privileges in OpenCTI 6.6.0-6.9.12 by impersonating any user account, including t
OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can
OpenCTI is an open cyber threat intelligence (CTI) platform. Rated critical severity (CVSS 9.1), this vulnerability is r
Server-Side Template Injection in OpenCTI notifier templates allows privileged administrators with 'Manage customization
OpenCTI is an open-source cyber threat intelligence platform. Rated high severity (CVSS 8.1), this vulnerability is remo
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observ
In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. Rated high
Privilege escalation in OpenCTI prior to 6.9.7 allows an organization admin to gain elevated platform-wide privileges by
Authorization bypass in OpenCTI prior to version 7.260326.0 lets any authenticated user holding the KNOWLEDGE_KNUPDATE p
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.
Elasticsearch Painless script injection via OpenCTI's GraphQL API allows any authenticated user holding the KNOWLEDGE ca
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today