RCE in Citeum Opencti
CVE-2026-35211
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (42.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 42.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Citeum Opencti
- Opencti-Platform Opencti — versions < 7.260401.0
Weakness classification (CWE)
References
- github.com/OpenCTI-Platform/opencti/commit/b134ccedf9e68386723cb42197f8e1d60c3b… (Patch)
- github.com/OpenCTI-Platform/opencti/pull/15284 (Patch, Issue Tracking)
- github.com/OpenCTI-Platform/opencti/releases/tag/7.260401.0 (Release Notes)
- github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-qpp6-p693-rmm4 (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-35211?
- CVE-2026-35211 is a medium-severity vulnerability in Citeum Opencti, classified under Code Injection. CVSS score: 6.5/10. Published 2026-07-08.
- How severe is CVE-2026-35211?
- Medium severity. CVSS v3 base score is 6.5 out of 10.