Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-76820OpenCTI: Synchronizer SSRF: stream fetch has no URL validation

High 7.7

In plain English

A high-severity server-side request forgery in opencti from OpenCTI-Platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.

Affected products (as reported)

Vendor	Product	Versions
OpenCTI-Platform	opencti	< 7.260701.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-f6pj-3m32-q934 x_refsource_CONFIRM
https://github.com/OpenCTI-Platform/opencti/pull/16617 x_refsource_MISC
https://github.com/OpenCTI-Platform/opencti/commit/6c1114ce8ce8f3a9d9b8c82dfff3a3a462e5dc1f x_refsource_MISC
https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260701.0 x_refsource_MISC