What is the CVSS score of EUVD-2026-27420?

EUVD-2026-27420 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of OpenCTI are affected by EUVD-2026-27420?

OpenCTI versions 6.6.0 through 6.9.12 contain a critical authentication bypass vulnerability (CVSS 9.8) that allows unauthenticated attackers to impersonate any user, including administrators, and…. A patch is available.

How to fix or mitigate EUVD-2026-27420?

Within 24 hours: Verify your OpenCTI version (6.6.0-6.9.12 are vulnerable); implement the vendor-provided workaround via configuration change detailed in vendor advisory; isolate OpenCTI instances from untrusted networks if possible. Within 7 days: Apply vendor patch when released (monitor for OpenCTI 6.9.13 or later); conduct full access audit to identify any unauthorized authentication attempts in API logs. Within 30 days: Complete migration to patched version; reset all user credentials and API tokens; review all threat intelligence exports and shares for unauthorized access.

OpenCTI EUVD-2026-27420

| CVE-2026-27960 CRITICAL

Improper Authentication (CWE-287)

2026-05-05 GitHub_M

Authentication Bypass Privilege Escalation Opencti

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 05, 2026 - 20:02 EUVD

Analysis Generated

May 05, 2026 - 19:30 vuln.today

DescriptionGitHub Advisory

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disabled using the APP__ADMIN__EXTERNALLY_MANAGED configuration.

AnalysisAI

Unauthenticated attackers can escalate privileges in OpenCTI 6.6.0-6.9.12 by impersonating any user account, including the default administrator, to query the threat intelligence platform's API without providing credentials. This authentication bypass (CWE-287) permits complete unauthorized access to cyber threat intelligence data with CVSS 9.8 critical severity. The vulnerability allows attackers to bypass all authentication controls and assume administrative privileges remotely with low attack complexity. Fixed in version 6.9.13 with workaround available via configuration change. No active exploitation (CISA KEV) or public POC confirmed at time of analysis, though EPSS data was not provided.

Technical ContextAI

OpenCTI is a threat intelligence platform built on GraphQL API architecture for managing cyber threat knowledge graphs and observables. The vulnerability stems from improper authentication (CWE-287) in the API layer affecting versions 6.6.0 through 6.9.12. The flaw allows attackers to craft API requests that bypass authentication checks entirely, then assume the identity of any valid user account in the system through privilege escalation. The default admin account presents the highest-value target, as it has full platform privileges for viewing, modifying, and deleting threat intelligence data. The CPE identifier cpe:2.3:a:opencti-platform:opencti indicates this affects the core OpenCTI platform across all deployment configurations during the vulnerable version range.

RemediationAI

Upgrade immediately to OpenCTI version 6.9.13 or later, which contains the authentication bypass fix per vendor advisory GHSA-6vvv-vmfr-xhrx available at https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-6vvv-vmfr-xhrx. Organizations unable to upgrade immediately should implement the workaround by setting the APP__ADMIN__EXTERNALLY_MANAGED configuration parameter to disable the default admin account, reducing the attack surface by eliminating the highest-privilege impersonation target. This workaround limits but does not eliminate risk, as attackers can still impersonate other user accounts with lower privileges to access threat intelligence data. The workaround requires external user management infrastructure and may disrupt automated workflows depending on admin account. Network-level compensating controls such as restricting API access to authenticated VPN connections or trusted IP ranges provide defense-in-depth but do not address the core authentication bypass and should not substitute for patching.