CVE-2026-76820: OpenCTI: Synchronizer SSRF: stream fetch has no URL validation
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenCTI synchronizerto a version that resolves this vulnerability.Fixed in 7.260701.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenCTI account with the INGESTION capability can exploit it. The attacker must be able to invoke the synchronizerFetch GraphQL query and provide a remote stream URL.
Which deployments are affected?
OpenCTI versions prior to 7.260701.0 are affected. The vulnerable backend accepted HTTP and HTTPS URLs without applying the ingestion deny list or blocking private, loopback, and link-local destinations.
What can an attacker do through the vulnerable fetch operation?
An attacker can cause the OpenCTI backend to send requests to internal services and cloud metadata endpoints. Response behavior can also be used to distinguish open HTTP ports, open non-HTTP ports, and closed ports for internal network scanning.
How can the risk be reduced before upgrading?
Restrict the INGESTION capability to trusted accounts, since that capability is required to exploit the issue. Upgrade to OpenCTI 7.260701.0, which fixes the URL validation issue.