CVE-2026-21887

The SSRF vulnerability in OpenCTI arises from insufficient validation of user-supplied URLs within the data ingestion feature. The platform utilizes the Axios HTTP client with the allowAbsoluteUrls: true configuration, enabling attackers to craft requests targeting internal resources. While responses might not be fully visible, the ability to trigger requests to internal systems poses a significant risk. An attacker could potentially scan internal networks, access sensitive data stored on internal servers, or even trigger actions within internal applications, depending on the exposed endpoints. This could lead to data breaches, system compromise, and disruption of services.

Organizations utilizing OpenCTI for threat intelligence management are at risk, particularly those with OpenCTI instances exposed to untrusted networks or those that ingest data from external sources without rigorous validation. Shared hosting environments where multiple users share the same OpenCTI instance are also at increased risk, as a compromised user could potentially exploit the vulnerability to access resources belonging to other users.

• linux / server: Monitor OpenCTI logs for unusual outbound HTTP requests, particularly those targeting internal IP addresses or non-standard ports. Use journalctl -f to observe real-time log activity.

journalctl -f | grep -i "http://192\.168\."

• generic web: Examine OpenCTI access and error logs for requests containing suspicious URL patterns, such as those containing internal IP addresses or unusual protocols. Use curl to test for SSRF by attempting to access an internal service.

curl -v http://localhost/internal_service

• python: If you have access to the OpenCTI code, review the data ingestion module for any instances where URLs are constructed and sent to Axios without proper validation.

1. 2026-03-12Disclosure

   disclosure

1. Réservé2026-01-05
2. Publiée2026-03-12
3. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-21887 is to upgrade OpenCTI to version 6.8.16 or later. If immediate upgrading is not feasible, consider implementing temporary workarounds. Restrict network access to the OpenCTI server to only necessary internal resources. Implement a Web Application Firewall (WAF) with rules to block requests containing suspicious URLs or patterns indicative of SSRF attempts. Carefully review and restrict the URLs allowed for data ingestion within the OpenCTI configuration. After upgrading, verify the fix by attempting to craft a request to an internal service and confirming that the request is blocked or fails as expected.