CVE-2026-27960: OpenCTI Privilege Escalation Vulnerability

CVE-2026-27960 Overview

CVE-2026-27960 is a critical authentication bypass vulnerability in OpenCTI, an open source platform for managing cyber threat intelligence knowledge and observables. The flaw affects versions 6.6.0 through 6.9.12 and allows unauthenticated attackers to query the OpenCTI API as any existing user, including the default admin account. The vulnerability is classified under [CWE-287] (Improper Authentication) and has been remediated in version 6.9.13.

Critical Impact

Unauthenticated remote attackers can impersonate any user, including the default admin, to read, modify, or destroy threat intelligence data stored in OpenCTI.

Affected Products

• OpenCTI Platform versions 6.6.0 through 6.9.12
• Self-hosted OpenCTI deployments using the default admin account
• Any OpenCTI instance exposed to untrusted networks

Discovery Timeline

• 2026-05-05 - CVE-2026-27960 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-27960

Vulnerability Analysis

CVE-2026-27960 is a privilege escalation vulnerability rooted in improper authentication within the OpenCTI API layer. An attacker who can reach the API endpoint over the network can issue queries that execute in the context of an existing user without supplying valid credentials. Because OpenCTI ships with a default admin account that holds full administrative authority over the platform, the impact extends to complete compromise of the threat intelligence dataset and connected integrations.

OpenCTI typically aggregates indicators, observables, malware profiles, and intrusion sets from multiple feeds. An attacker exploiting this flaw can exfiltrate proprietary threat intelligence, plant fabricated indicators to mislead downstream security tooling, or disable connectors to disrupt enrichment workflows. The vulnerability requires no user interaction and no prior authentication.

Root Cause

The root cause is an authentication weakness in how the OpenCTI API resolves the calling identity. Versions 6.6.0 through 6.9.12 permit API queries to execute under the identity of arbitrary users without enforcing valid session or token-based authentication. The default admin account is the most attractive target because it holds unrestricted privileges across the platform.

Attack Vector

Exploitation occurs over the network against the OpenCTI GraphQL API. The attacker crafts API requests that reference an existing user, typically the default admin, and receives a response as if that user issued the call. No credentials, multi-factor prompts, or user interaction are required. Refer to the OpenCTI GitHub Security Advisory for additional technical context.

Detection Methods for CVE-2026-27960

Indicators of Compromise

• Unexpected API queries originating from external IP addresses targeting /graphql endpoints on OpenCTI instances
• Audit log entries showing admin-level actions without a corresponding successful login event
• New or modified user accounts, connectors, or API tokens that cannot be attributed to a known administrator
• Sudden bulk export or modification of threat intelligence entities

Detection Strategies

• Inspect OpenCTI application logs for API requests that lack a preceding authentication event for the acting user
• Correlate reverse-proxy or load-balancer access logs with OpenCTI audit trails to identify identity mismatches
• Alert on any administrative GraphQL mutations executed outside of approved maintenance windows or trusted IP ranges

Monitoring Recommendations

• Forward OpenCTI audit logs and web server access logs to a centralized SIEM for correlation and retention
• Monitor egress traffic from the OpenCTI host for large data transfers that could indicate threat intelligence exfiltration
• Review user, group, and role changes daily until upgrade to version 6.9.13 is confirmed

How to Mitigate CVE-2026-27960

Immediate Actions Required

• Upgrade OpenCTI to version 6.9.13 or later, which contains the fix for CVE-2026-27960
• Restrict network access to the OpenCTI API to trusted management networks until the upgrade is applied
• Rotate all API tokens, user passwords, and integration secrets stored in OpenCTI after upgrading
• Review audit logs for activity dating back to the deployment of any version in the 6.6.0 through 6.9.12 range

Patch Information

The OpenCTI maintainers fixed CVE-2026-27960 in version 6.9.13. Administrators should follow the upgrade procedure documented in the OpenCTI GitHub Security Advisory GHSA-6vvv-vmfr-xhrx and validate the running version after deployment.

Workarounds

• Disable the default admin account by setting the APP__ADMIN__EXTERNALLY_MANAGED configuration option, as recommended by the vendor
• Place OpenCTI behind a reverse proxy that enforces network-level authentication or IP allowlisting
• Isolate OpenCTI instances from internet exposure until the patched version is in production

# Configuration example: disable default admin via environment variable
export APP__ADMIN__EXTERNALLY_MANAGED=true

# Or set in config/default.json
# "app": {
#   "admin": {
#     "externally_managed": true
#   }
# }

# Verify upgraded version
curl -s https://opencti.example.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{ about { version } }"}'