CVE-2026-35211

{
  "id": "CVE-2026-35211",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T21:16:48.630",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0."
    },
    {
      "lang": "es",
      "value": "OpenCTI es una plataforma de código abierto para gestionar el conocimiento y los observables de la inteligencia de ciberamenazas. Antes de la versión 7.260401.0, la API GraphQL de OpenCTI expone un operador de filtro de script en su enumeración FilterOperator que permite a cualquier usuario autenticado con la capacidad KNOWLEDGE pasar valores de script Painless de Elasticsearch proporcionados por el usuario directamente a las consultas de búsqueda sin validación ni saneamiento, lo que permite que scripts computacionalmente costosos consuman recursos de CPU del clúster y degraden o denieguen el servicio a todos los usuarios. Este problema está solucionado en la versión 7.260401.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "OpenCTI-Platform",
          "product": "opencti",
          "versions": [
            {
              "version": "< 7.260401.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-10T14:45:58.349167Z",
          "id": "CVE-2026-35211",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:citeum:opencti:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "7.260401.0",
              "matchCriteriaId": "3890BF2D-1F6D-46BC-9217-5823DBE90085"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/OpenCTI-Platform/opencti/commit/b134ccedf9e68386723cb42197f8e1d60c3bdbd9",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/OpenCTI-Platform/opencti/pull/15284",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260401.0",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-qpp6-p693-rmm4",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}