{"id":"CVE-2026-76820","aliases":["EUVD-2026-79241","GHSA-f6pj-3m32-q934"],"status":"published","title":"OpenCTI: Synchronizer SSRF: stream fetch has no URL validation","description":"OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00415,"percentile":0.36143,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2026-09-15T19:40:39Z","modified":"2026-10-28T02:30:42Z","products":[{"vendor":"opencti-platform","product":"opencti"}],"references":[{"url":"https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-f6pj-3m32-q934","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/OpenCTI-Platform/opencti/pull/16617","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/OpenCTI-Platform/opencti/commit/6c1114ce8ce8f3a9d9b8c82dfff3a3a462e5dc1f","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260701.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76820.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76820","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-76820","title":"OpenCTI: Synchronizer SSRF: stream fetch has no URL validation","description":"OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.","status":"published","published":"2026-09-15T19:40:39.727Z","modified":"2026-09-16T19:23:48.304Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:46:21.568011Z"}],"euvd":[{"id":"EUVD-2026-79241","description":"OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.","status":"published","published":"2026-09-15T19:40:39Z","modified":"2026-09-16T19:23:48Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:14.33177Z"}],"nvd":[{"id":"CVE-2026-76820","description":"OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.","status":"published","published":"2026-09-15T20:17:57.127Z","modified":"2026-09-30T17:43:24.057Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:47.974509Z"}],"osv":[{"id":"CVE-2026-76820","title":"OpenCTI: Synchronizer SSRF: stream fetch has no URL validation","description":"OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny list or reject private, loopback, and link-local destinations, allowing an authenticated account with the INGESTION capability to make OpenCTI request internal services and cloud metadata endpoints. Returned connection errors could distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network scanning, while compatible endpoint responses could disclose internal data. This issue is fixed in version 7.260701.0.","status":"published","published":"2026-09-15T19:40:39.727Z","modified":"2026-10-28T02:30:42.179199726Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:45:17.102988Z"}]}}