CVE-2026-35211: OpenCTI GraphQL API Denial of Service via Unsanitized Painless Scripts

Technical summary

The vulnerability exists in OpenCTI versions prior to 7.260401.0 within the GraphQL API's FilterOperator enum. The script filter operator accepts unsanitized Elasticsearch Painless script values directly from authenticated requests. An attacker with KNOWLEDGE capability can pass arbitrary Painless expressions that execute expensive computational operations on the Elasticsearch cluster, consuming CPU and degrading cluster performance. The vulnerability stems from insufficient input validation and sanitization of user-supplied script parameters before they reach the Elasticsearch query engine. CWE-863 (Incorrect Authorization) and CWE-94 (Improper Control of Generation of Code) are the contributing weaknesses.

Business impact

Organizations running OpenCTI as their threat intelligence platform face potential service disruptions during normal operations. An authenticated insider or compromised account holder can degrade or deny access to threat intelligence data for the entire organization without sophisticated tooling. This impacts incident response workflows, threat hunting capabilities, and any downstream systems relying on OpenCTI API availability. The impact is operational rather than confidential—no data exposure or integrity compromise—but availability loss of a central intelligence system can cascade across security operations.

Affected systems

OpenCTI versions prior to 7.260401.0 are affected. This includes all Citeum OpenCTI deployments running older releases. The vulnerability requires the attacker to possess valid credentials and the KNOWLEDGE capability, limiting the attack surface to authenticated users within the organization or those with compromised accounts.

Exploitability

Exploitation requires valid authentication credentials and the KNOWLEDGE capability within OpenCTI. No network or authentication bypass is needed—the vulnerability is accessible through the standard GraphQL API endpoint. Crafting a malicious script requires understanding Elasticsearch Painless syntax, but proof-of-concept payloads are conceptually straightforward. The CVSS score of 6.5 (MEDIUM) reflects the authentication requirement balanced against the high availability impact. This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade OpenCTI to version 7.260401.0 or later, which implements validation and sanitization of script filter values. Organizations unable to patch immediately should restrict KNOWLEDGE capability permissions to trusted users only and monitor Elasticsearch cluster metrics for unusual CPU spikes that may indicate exploitation attempts.

Patch guidance

Apply the update to OpenCTI 7.260401.0 or later as soon as possible. Verify the update is available through your deployment channel (container images, package managers, or source builds depending on your deployment method). Test the upgrade in a non-production environment first to ensure compatibility with your threat intelligence workflows and any custom integrations. Review user access and KNOWLEDGE capability assignments during the patching window.

Detection guidance

Monitor Elasticsearch cluster CPU utilization and query latency for anomalies, particularly spikes correlated with GraphQL API requests. Enable query logging in Elasticsearch to capture slow or resource-intensive Painless script executions. Check GraphQL API audit logs for unusual script filter parameters in queries from unexpected users or at atypical times. Baseline normal query patterns first to establish detection thresholds. Network-based detection is difficult without decrypting HTTPS traffic; focus on application and infrastructure logs.

Why prioritize this

This vulnerability should be prioritized for patching within 30 days. While authentication is required, threat intelligence platforms are often access-rich environments where multiple users hold elevated permissions. The potential for insider threat or credential compromise is relevant in many organizations. The availability impact directly affects security operations, making it more urgent than low-impact vulnerabilities, though lower priority than critical remote code execution or confidentiality breaches.

Risk score, explained

CVSS 6.5 (MEDIUM) accurately reflects this vulnerability's profile. The authentication requirement significantly reduces the attack surface (PR:L), preventing unauthenticated exploitation. However, the high availability impact (A:H) is not mitigated by the authentication barrier since authorized users can exploit it. No confidentiality or integrity impact exists. This is a classic insider/compromised-account denial-of-service scenario with operational but not strategic consequences.

Frequently asked questions