CVE-2026-35210: OpenCTI Authorization Bypass Vulnerability

CVE-2026-35210 Overview

CVE-2026-35210 is an authorization bypass vulnerability in OpenCTI, an open source platform for managing cyber threat intelligence knowledge and observables. Authenticated users with KNOWLEDGE_KNUPDATE permission can bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header. Attackers exploit this flaw to downgrade confidence levels, strip security markings such as TLP:RED, manipulate relationships, and alter STIX object types including Indicators, ThreatActors, Malware, and Reports. The issue is resolved in version 7.260326.0. The weakness is classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated user with basic knowledge-update rights can silently remove TLP:RED markings and rewrite sensitive threat intelligence, undermining the integrity of the entire CTI repository.

Affected Products

OpenCTI Platform versions prior to 7.260326.0
OpenCTI GraphQL backend (opencti-platform/opencti-graphql)
Deployments exposing the OpenCTI API to authenticated users with KNOWLEDGE_KNUPDATE

Discovery Timeline

2026-07-08 - CVE-2026-35210 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-35210

Vulnerability Analysis

OpenCTI relies on the synchronized-upsert HTTP header to signal internal synchronization operations between trusted platform components. When this header is set, the backend bypasses standard authorization controls that normally enforce Confidence Level validation and Object Marking restrictions on STIX entities.

The platform did not verify that the caller had bypass privileges before honoring the header. Any authenticated user holding the KNOWLEDGE_KNUPDATE capability could set the header on ordinary GraphQL mutations and gain the same privileged code path used by synchronization workers. This enables silent modification of high-integrity metadata, including TLP markings that gate distribution of threat intelligence.

Root Cause

The root cause is missing privilege validation on a trust-elevating request header. Header-driven trust decisions in userWithOrigin and the authenticated HTTP context did not check whether the requesting user was actually a bypass user, allowing user-controlled input to override server-side access decisions [CWE-639].

Attack Vector

Exploitation requires an authenticated session with the KNOWLEDGE_KNUPDATE permission and network access to the OpenCTI API. The attacker issues a normal update or upsert request while adding the synchronized-upsert: true header, causing the backend to skip confidence and marking checks and apply the mutation as if it originated from a trusted synchronizer.

javascript

// Patch excerpt: opencti-graphql/src/domain/user.js
   await notify(BUS_TOPICS[ENTITY_TYPE_USER].EDIT_TOPIC, users, user);
 };

-export const userWithOrigin = (req, user) => {
+export const userWithOrigin = (req, user, originHeaders = {}) => {
   // /!\ This metadata information is used in different ways
   // - In audit logs to identify the user
   // - In stream message to also identifier the user

javascript

// Patch excerpt: opencti-graphql/src/http/httpAuthenticatedContext.js
 import { batchGlobalStatusesByType, batchRequestAccessStatusesByType } from '../domain/status';
 import { batchEntitySettingsByType } from '../modules/entitySetting/entitySetting-domain';
 import { batchIsSubAttackPattern } from '../domain/attackPattern';
-import { executionContext, isUserInPlatformOrganization, SYSTEM_USER } from '../utils/access';
+import { executionContext, isBypassUser, isUserInPlatformOrganization, SYSTEM_USER } from '../utils/access';
 import { getEnterpriseEditionInfo, IS_LTS_PLATFORM } from '../modules/settings/licensing';
 import { batchContextDataForLog } from '../database/data-changes';

Source: OpenCTI security patch commit 134531d. The fix introduces isBypassUser gating and threads origin headers through userWithOrigin so the header is only honored for users that are actually authorized to bypass validation.

Detection Methods for CVE-2026-35210

Indicators of Compromise

Inbound HTTP requests to the OpenCTI GraphQL endpoint carrying the synchronized-upsert: true header from non-synchronizer user sessions.
Audit log entries showing sudden downgrades of confidence values or removal of TLP:RED, TLP:AMBER+STRICT, or TLP:AMBER markings on Indicators, ThreatActors, Malware, or Reports.
Unexpected modifications to STIX relationships by low-privilege accounts holding only KNOWLEDGE_KNUPDATE.

Detection Strategies

Inspect reverse proxy or ingress logs for the synchronized-upsert header and correlate against the identity of the authenticated user issuing the call.
Baseline which service accounts are expected to perform synchronization operations and alert on the header appearing from any other principal.
Query OpenCTI history and audit streams for object updates where marking definitions were removed or confidence levels dropped without a corresponding workflow.

Monitoring Recommendations

Forward OpenCTI application logs and API access logs to a centralized analytics tier for long-term retention and correlation.
Alert on high-value STIX object edits, particularly changes to object_marking_refs and confidence fields on Reports, Indicators, and ThreatActors.
Track authentication events for accounts with KNOWLEDGE_KNUPDATE and flag any that begin issuing header-manipulated requests.

How to Mitigate CVE-2026-35210

Immediate Actions Required

Upgrade OpenCTI to version 7.260326.0 or later, which introduces the isBypassUser check on the synchronized-upsert code path.
Audit all users granted KNOWLEDGE_KNUPDATE and revoke the permission where it is not strictly required.
Review historical changes to Indicators, ThreatActors, Malware, and Reports for unauthorized marking downgrades and restore trusted values.

Patch Information

The fix is delivered in the OpenCTI 7.260326.0 release and detailed in GitHub Security Advisory GHSA-36fr-4m54-94mj. The corresponding code change is available in Pull Request #14243 and commit 134531d.

Workarounds

Configure the fronting reverse proxy or API gateway to strip the synchronized-upsert header from client requests before they reach the OpenCTI GraphQL service.
Restrict the KNOWLEDGE_KNUPDATE capability to a minimal set of trusted analysts until the upgrade is deployed.
Segment synchronization service accounts to dedicated network paths so header-based trust can be enforced at the network layer.

bash

# Example NGINX rule to strip the synchronized-upsert header from external clients
location /graphql {
    proxy_set_header synchronized-upsert "";
    proxy_pass http://opencti-graphql:4000;
}