CVE-2026-35211: OpenCTI DoS Vulnerability via Painless

CVE-2026-35211 Overview

CVE-2026-35211 affects OpenCTI, an open source platform for managing cyber threat intelligence knowledge and observables. The OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum. Any authenticated user holding the KNOWLEDGE capability can pass user-supplied Elasticsearch Painless script values directly into search queries. The API performs no validation or sanitization on the submitted script body. Attackers can submit computationally expensive scripts that consume cluster CPU resources and deny service to all platform users. The issue is fixed in version 7.260401.0. This weakness is categorized under CWE-94: Improper Control of Generation of Code.

Critical Impact
An authenticated user with KNOWLEDGE capability can execute arbitrary Painless scripts against the backing Elasticsearch or OpenSearch cluster, exhausting CPU resources and causing a platform-wide denial of service.

Affected Products

OpenCTI Platform versions prior to 7.260401.0
Deployments using Elasticsearch as the backing search engine
Deployments using OpenSearch as the backing search engine

Discovery Timeline

2026-07-08 - CVE-2026-35211 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-35211

Vulnerability Analysis

OpenCTI relies on Elasticsearch or OpenSearch as its underlying search and storage engine. The GraphQL FilterOperator enum included a script operator that forwarded a caller-controlled Painless expression into the search query body. Painless is a scripting language that supports loops, arithmetic operations, and iteration over document fields. When executed at query time, a malicious script can pin worker threads and saturate cluster CPU capacity.

Because the filter accepted any authenticated user holding the KNOWLEDGE capability, this attack does not require administrative privileges. The scope is a resource exhaustion denial of service against the shared search cluster, which degrades every tenant and query pipeline that depends on it.

Root Cause

The root cause is missing input validation on a GraphQL filter operator that maps directly to server-side script execution. The script operator was exposed by default through the public API without a feature flag or role gate. There was no allowlist, no complexity limit, and no execution budget enforced before the script reached the search engine.

Attack Vector

An authenticated attacker submits a GraphQL query that uses the script filter operator with a Painless payload designed to consume CPU cycles, such as a large loop or nested iteration. The search engine compiles and executes the script for each candidate document. Repeated submissions or a single sufficiently expensive script starve query workers, causing timeouts for other users.

typescript

// Patch: opencti-platform/opencti-graphql/src/database/engine-config.ts
+import { booleanConf } from '../config/conf';
+
+const ES_SCRIPT_FILTER_ENABLED: boolean = booleanConf('elasticsearch:unsecure_script_filter_enabled', false);
+export const isEsScriptFilterEnabled = () => {
+  return ES_SCRIPT_FILTER_ENABLED;
+};

Source: GitHub Commit b134ccedf9e68386723cb42197f8e1d60c3bdbd9

The patch introduces a configuration flag elasticsearch:unsecure_script_filter_enabled that defaults to false. Script filter usage is moved to an internal-only code path (internal_script) and removed from the public GraphQL API surface unless an operator explicitly opts in.

typescript

// Patch: opencti-platform/opencti-graphql/src/database/engine.ts
 import { pushAll, unshiftAll } from '../utils/arrayUtil';
 import { getRoleAssumerWithWebIdentity } from '../utils/awsSdk';
 import { elConvertHits, elConvertHitsToMap, INNER_HITS_WINDOWS_SIZE } from './engine-data-converter';
+import { isEsScriptFilterEnabled } from './engine-config';
 
 const ELK_ENGINE = 'elk';
 const OPENSEARCH_ENGINE = 'opensearch';

Source: GitHub Commit b134ccedf9e68386723cb42197f8e1d60c3bdbd9

Detection Methods for CVE-2026-35211

Indicators of Compromise

GraphQL requests containing FilterOperator value script targeting the OpenCTI API endpoint.
Elasticsearch or OpenSearch slow query logs showing Painless script executions originating from OpenCTI service accounts.
Sustained high CPU utilization on search cluster data nodes correlated with authenticated OpenCTI user sessions.

Detection Strategies

Inspect GraphQL query bodies at the reverse proxy or API gateway for the script operator value and flag or drop matching requests.
Enable Elasticsearch audit logging for script and search actions and correlate script compilation events with the requesting OpenCTI user.
Baseline normal query latency and alert on anomalous spikes in search worker thread pool queue depth.

Monitoring Recommendations

Monitor the elasticsearch:unsecure_script_filter_enabled configuration value across all environments and alert if it is set to true.
Track GraphQL request rates per authenticated user with the KNOWLEDGE capability and flag deviations from historical baselines.
Review the OpenCTI audit trail for unusual filter combinations submitted by non-administrative accounts.

How to Mitigate CVE-2026-35211

Immediate Actions Required

Upgrade OpenCTI to version 7.260401.0 or later, which removes the script filter operator from the default API surface.
Verify the new configuration key elasticsearch:unsecure_script_filter_enabled remains set to false in production deployments.
Audit accounts holding the KNOWLEDGE capability and revoke access for users who do not require it.

Patch Information

The fix is delivered in OpenCTI Release 7.260401.0. See Pull Request #15284 and the GitHub Security Advisory GHSA-qpp6-p693-rmm4 for full technical detail. The commit b134ccedf9e68386723cb42197f8e1d60c3bdbd9 moves script usage to an internal path and gates external access behind an explicit opt-in flag.

Workarounds

If an immediate upgrade is not possible, disable Painless inline scripting at the Elasticsearch or OpenSearch layer using the cluster settings API.
Deploy an API gateway rule to reject GraphQL requests whose filter operator equals script.
Restrict the KNOWLEDGE capability to a minimal set of trusted, audited service accounts and analysts.

bash

# Disable inline Painless scripting at the search cluster level
curl -X PUT "https://elasticsearch.internal:9200/_cluster/settings" \
  -H 'Content-Type: application/json' \
  -d '{
    "persistent": {
      "script.allowed_types": "stored",
      "script.allowed_contexts": "none"
    }
  }'

# Confirm OpenCTI configuration keeps the script filter disabled
grep -E 'unsecure_script_filter_enabled' /opt/opencti/config/production.json