CVE-2026-21887 — OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature

Description (CNA)

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16.

Affected (CNA)

Vendor / product	Versions
OpenCTI-Platform / opencti	affected < 6.8.16

CWE

CWE-918

References

https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-ffm6-vvph-g5f5

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.