EUVD-2026-79241Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
5DescriptionCVE.org
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.
AnalysisAI
Server-side request forgery in OpenCTI versions prior to 7.260701.0 lets an authenticated account holding the INGESTION capability force the platform to issue outbound HTTP(S) requests to arbitrary destinations, including loopback, link-local, private-range and cloud metadata endpoints, because the synchronizerFetch GraphQL query only validated that the supplied URL used HTTP or HTTPS and never applied the ingestion deny list. Distinguishable connection errors let the attacker map internal services (open HTTP ports, open non-HTTP ports and closed ports), while responses from compatible endpoints can leak internal data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today