CVE-2026-35211: OpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoS
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35211?
CVE-2026-35211 has a medium severity level of 6.5.
What kind of vulnerability is CVE-2026-35211?
CVE-2026-35211 is a Code Injection vulnerability affecting OpenCTI.
How can CVE-2026-35211 be exploited?
CVE-2026-35211 can be exploited by an authenticated user to execute a malicious Elasticsearch Painless script through the GraphQL API.
How do I fix CVE-2026-35211?
To fix CVE-2026-35211, update OpenCTI to version 7.260401.0 or later.
What impact does CVE-2026-35211 have if exploited?
If exploited, CVE-2026-35211 can lead to data exfiltration and a denial of service (DoS) condition.