« Volver al listado

CVE-2026-21887

Estado: AnalizadaAlta (7.7)—

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

SSRF en OpenCTI sin validación de URLs permite atacante autenticado (PR:L) acceder a servicios internos vía Axios. CWE-918 confirma SSRF; respuestas semi-ciegas permiten lectura de datos internos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramSSL/TLS InspectionPrivileged Account ManagementNetwork SegmentationNetwork Intrusion Prevention

Tecnologías afectadas (1)

Citeum — Opencti

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-21887",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-21887",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-12T17:51:53.670909Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "OpenCTI-Platform",
          "product": "opencti",
          "versions": [
            {
              "status": "affected",
              "version": "< 6.8.16"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-12T17:16:36.813",
  "references": [
    {
      "url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-ffm6-vvph-g5f5",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16."
    },
    {
      "lang": "es",
      "value": "OpenCTI es una plataforma de código abierto para gestionar el conocimiento y los observables de inteligencia de amenazas cibernéticas. Antes de la versión 6.8.16, la función de ingesta de datos de la plataforma OpenCTI acepta URLs proporcionadas por el usuario sin validación y utiliza el cliente HTTP Axios con su configuración predeterminada (allowAbsoluteUrls: true). Esto permite a los atacantes elaborar solicitudes a puntos finales arbitrarios, incluidos servicios internos, porque Axios aceptará y procesará URLs absolutas. Esto resulta en un SSRF semi-ciego, ya que las respuestas pueden no ser completamente visibles pero aún pueden impactar sistemas internos. Esta vulnerabilidad se corrige en la versión 6.8.16."
    }
  ],
  "lastModified": "2026-06-17T10:19:05.640",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:citeum:opencti:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83864C1B-398F-4EBC-BFB1-D13968FD7D06",
              "versionEndExcluding": "6.8.16"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}