Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
OpenCTI Platform Allows Malicious URLs to Access Internal Systems
CVE-2026-21887
Summary
The OpenCTI platform's data ingestion feature doesn't check URLs, allowing attackers to access internal systems. This could lead to unauthorized access or disruption of internal services. Update to version 6.8.16 or later to fix the issue.
Original title
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs withou...
Original description
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16.
nvd CVSS3.1
7.7
Vulnerability type
CWE-918
Server-Side Request Forgery (SSRF)
Published: 12 Mar 2026 · Updated: 13 Mar 2026 · First seen: 12 Mar 2026