CVE-2026-76820

OpenCTI, the open-source cyber threat intelligence platform, contains a server-side request forgery (SSRF) flaw in the synchronizerFetch GraphQL query: before version 7.260701.0, the backend only verified that a remote stream URL used HTTP or HTTPS before calling fetchRemoteStreams, without applying the ingestion deny list or blocking private, loopback, or link-local destinations. An authenticated attacker holding the INGESTION capability can supply a stream URL pointing at internal services or cloud metadata endpoints, causing the OpenCTI server to make the request on their behalf. Differing connection errors let the attacker distinguish open HTTP ports, open non-HTTP ports, and closed ports, enabling internal network reconnaissance, while responses from compatible endpoints can leak internal data. All OpenCTI versions prior to 7.260701.0 are affected; the flaw is rated high severity (CVSS 3.1 score 7.7) due to its high confidentiality impact across a security scope change, though it requires an authenticated INGESTION-capable account. There is no known public proof of concept and the issue is not in CISA's KEV catalog, so no exploitation is known to date.

What to do: Upgrade OpenCTI to version 7.260701.0 or later, which applies the ingestion deny list and rejects private, loopback, and link-local destinations. In the interim, audit which accounts hold the INGESTION capability and revoke it from untrusted users, and restrict the server's egress to internal networks and metadata endpoints (e.g., 169.254.169.254). Review logs for synchronizerFetch calls targeting internal IP ranges or unusual ports, which would indicate attempted internal scanning or data collection.