CVE-2026-76820: OpenCTI SSRF Vulnerability

CVE-2026-76820 Overview

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. CVE-2026-76820 is a Server-Side Request Forgery (SSRF) vulnerability in the synchronizerFetch GraphQL query. The backend validated only that a remote stream URL used HTTP or HTTPS. It did not apply the ingestion deny list or reject private, loopback, and link-local destinations. An authenticated account with the INGESTION capability can force OpenCTI to issue requests to internal services and cloud metadata endpoints. The issue is fixed in version 7.260701.0.

Critical Impact
An authenticated attacker with INGESTION capability can scan internal networks, fingerprint services, and reach cloud metadata endpoints to disclose sensitive internal data.

Affected Products

OpenCTI Platform versions prior to 7.260701.0
OpenCTI GraphQL backend (opencti-graphql)
Deployments exposing the synchronizerFetch ingestion API

Discovery Timeline

2026-09-15 - CVE-2026-76820 published to NVD
2026-09-16 - Last updated in NVD database
Fixed release - OpenCTI version 7.260701.0

Technical Details for CVE-2026-76820

Vulnerability Analysis

The flaw sits in the synchronizerFetch GraphQL resolver, which calls fetchRemoteStreams against a user-supplied URL. The pre-flight check confirmed only the URL scheme was HTTP or HTTPS. It did not consult OpenCTI's ingestion deny list or block requests to RFC1918 ranges, 127.0.0.0/8, or 169.254.0.0/16. Because the OpenCTI backend performs the outbound request, the attacker inherits the network position of the server. The response paths distinguish between open HTTP ports, open non-HTTP ports, and closed ports, producing a reliable oracle for internal port scanning. Compatible endpoints that return stream-shaped data can leak their contents back through the GraphQL response. This is classified as CWE-918: Server-Side Request Forgery.

Root Cause

Input validation for the remote stream URL was limited to a scheme check. The backend skipped host validation, so private, loopback, link-local, and metadata-service hostnames were treated as valid ingestion targets.

Attack Vector

An authenticated OpenCTI user holding the INGESTION capability submits a synchronizerFetch mutation with a crafted URL such as http://169.254.169.254/latest/meta-data/ or http://127.0.0.1:6379/. The backend fetches the target and returns error or content signals that allow the attacker to map internal infrastructure and, in cloud deployments, retrieve instance metadata and temporary credentials.

typescript

// Patch excerpt: opencti-platform/opencti-graphql/src/domain/connector.ts
// fix(ingestion): verifyIngestionUri on backend for streams (#16341)
   type EditManagedConnectorInput,
   type HealthConnectorStatusInput,
   type LogsConnectorStatusInput,
-  type MutationSynchronizerTestArgs,
   type RegisterConnectorInput,
   type RegisterConnectorsManagerInput,
   type RequestConnectorStatusInput,

Source: OpenCTI commit 6c1114c. The fix introduces backend-side verifyIngestionUri validation for stream ingestion so the deny list and private-address checks are always enforced.

Detection Methods for CVE-2026-76820

Indicators of Compromise

Outbound HTTP requests from the OpenCTI backend to RFC1918, loopback, or link-local addresses.
Backend connections to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
GraphQL audit entries showing synchronizerFetch or fetchRemoteStreams calls with unusual host targets.
Bursts of short-lived outbound connections to sequential internal ports, indicating port scanning.

Detection Strategies

Parse OpenCTI application logs for synchronizerFetch operations and correlate the target URL against internal address ranges.
Inspect egress firewall or service-mesh logs for OpenCTI pod or host connections to internal or metadata destinations.
Alert on repeated non-2xx responses from the OpenCTI backend against internal IPs, a signature of SSRF-based scanning.

Monitoring Recommendations

Audit accounts assigned the INGESTION capability and review creation of new synchronizers.
Track GraphQL request rates per user for ingestion-related mutations and flag anomalies.
Forward OpenCTI and network egress telemetry to a centralized data lake for cross-source correlation.

How to Mitigate CVE-2026-76820

Immediate Actions Required

Upgrade OpenCTI to version 7.260701.0 or later without delay.
Review and reduce the set of users holding the INGESTION capability to the minimum required.
Rotate any cloud instance credentials the OpenCTI backend can reach if exploitation cannot be ruled out.

Patch Information

The fix is delivered in OpenCTI 7.260701.0 via pull request #16617 and commit 6c1114c. Details are documented in GHSA-f6pj-3m32-q934. The patch enforces verifyIngestionUri on the backend so stream URLs are validated against the ingestion deny list and private-address rules.

Workarounds

Restrict egress from the OpenCTI backend using network policies that block RFC1918, loopback, link-local, and cloud metadata destinations.
Enforce IMDSv2 on AWS or equivalent hardened metadata modes on other cloud providers to require session tokens.
Temporarily revoke the INGESTION capability from non-administrative accounts until the upgrade is complete.

bash

# Example: block OpenCTI backend egress to cloud metadata and private ranges
iptables -A OUTPUT -d 169.254.169.254/32 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT