CVE-2026-21887: OpenCTI SSRF Vulnerability

CVE-2026-21887 Overview

CVE-2026-21887 is a Server-Side Request Forgery (SSRF) vulnerability affecting OpenCTI, an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.16, the OpenCTI platform's data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems.

Critical Impact

Authenticated attackers can exploit this SSRF vulnerability to reach internal network services, potentially exposing sensitive internal infrastructure and enabling further attacks against backend systems that should not be externally accessible.

Affected Products

• OpenCTI versions prior to 6.8.16

Discovery Timeline

• 2026-03-12 - CVE CVE-2026-21887 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-21887

Vulnerability Analysis

This vulnerability is classified under CWE-918 (Server-Side Request Forgery). The flaw exists in OpenCTI's data ingestion functionality, which is designed to fetch external threat intelligence data. The implementation fails to properly validate user-supplied URLs before making HTTP requests using the Axios library.

The Axios HTTP client is configured with its default settings, which include allowAbsoluteUrls: true. This permissive configuration allows the application to make requests to any URL provided by the user, including internal network addresses, localhost services, and cloud metadata endpoints. An authenticated attacker with access to the data ingestion feature can leverage this to probe internal infrastructure.

The vulnerability is characterized as a "semi-blind" SSRF because while the full HTTP response content may not be returned to the attacker, side-channel information such as response timing, error messages, or partial data exposure can still reveal sensitive information about internal network topology and services.

Root Cause

The root cause of this vulnerability is the lack of URL validation and sanitization in the data ingestion feature. The OpenCTI platform directly passes user-controlled URLs to the Axios HTTP client without implementing any allowlist, blocklist, or URL scheme restrictions. This allows attackers to specify arbitrary destinations including internal IP ranges (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x), cloud metadata services (e.g., 169.254.169.254), and other internal services that should not be accessible from external inputs.

Attack Vector

The attack vector is network-based and requires low privileges (authenticated user access). An attacker with valid credentials to the OpenCTI platform can navigate to the data ingestion functionality and submit crafted URLs targeting internal services. The attack does not require user interaction and can impact systems beyond the vulnerable component's security scope, potentially reaching internal services that have no direct external exposure.

Typical exploitation scenarios include:

• Probing internal network services and ports to map infrastructure
• Accessing cloud provider metadata services to extract credentials or instance information
• Reaching internal APIs or administrative interfaces that lack authentication when accessed from trusted internal networks
• Triggering actions on internal services that respond to HTTP requests

Detection Methods for CVE-2026-21887

Indicators of Compromise

• Unusual outbound HTTP requests from the OpenCTI server to internal IP ranges such as 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16
• HTTP requests targeting cloud metadata endpoints like 169.254.169.254
• Data ingestion requests containing URLs with non-standard ports or internal hostnames
• Unexpected connection attempts from the OpenCTI application to backend services

Detection Strategies

• Monitor OpenCTI application logs for data ingestion requests containing internal IP addresses or localhost references
• Implement network-level detection for outbound traffic from the OpenCTI server to internal network segments
• Configure web application firewall rules to flag requests containing internal network indicators in URL parameters
• Review audit logs for authenticated users submitting unusual or repeated data ingestion requests

Monitoring Recommendations

• Enable verbose logging on the OpenCTI platform to capture all data ingestion URL submissions
• Deploy network segmentation monitoring to detect lateral movement attempts from the OpenCTI server
• Implement egress filtering alerts for the OpenCTI server attempting to reach internal services
• Regularly review authentication logs for accounts accessing the data ingestion feature

How to Mitigate CVE-2026-21887

Immediate Actions Required

• Upgrade OpenCTI to version 6.8.16 or later immediately
• Audit data ingestion activity logs to identify potential exploitation attempts
• Review network access controls for the OpenCTI server to limit outbound connectivity to only necessary external resources
• Temporarily restrict access to the data ingestion feature for non-essential users until patching is complete

Patch Information

This vulnerability is fixed in OpenCTI version 6.8.16. The patch implements proper URL validation to prevent requests to internal network addresses and restricts the Axios HTTP client configuration. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Implement network-level egress filtering to block the OpenCTI server from reaching internal IP ranges through outbound HTTP requests
• Deploy a proxy server between OpenCTI and external resources with strict URL allowlisting
• Restrict access to the data ingestion functionality to only trusted administrators until the patch can be applied
• Configure firewall rules to prevent the OpenCTI application server from initiating connections to internal network segments

# Example: Network-level mitigation using iptables to block internal network access from OpenCTI server
# Block access to common internal network ranges
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner opencti -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner opencti -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner opencti -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner opencti -j DROP
iptables -A OUTPUT -d 169.254.169.254/32 -m owner --uid-owner opencti -j DROP