RCE in Citeum Opencti
CVE-2026-35211
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.004 (30.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Citeum Opencti
- Opencti-platform Opencti — versions < 7.260401.0
Weakness classification (CWE)
References
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-35211?
- CVE-2026-35211 is a medium-severity vulnerability in Citeum Opencti, classified under Code Injection. CVSS score: 6.5/10. Published 2026-07-08.
- How severe is CVE-2026-35211?
- Medium severity. CVSS v3 base score is 6.5 out of 10.