CVE-2026-21887

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs. This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems. This vulnerability is fixed in 6.8.16.

• CWE-918

• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-ffm6-vvph-g5f5Vendor Advisory

Published

Mar 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21881Kanboard is project management software focused on Kanban me…9.1
• CVE-2026-21882theshit is a command-line utility that automatically detects…8.4
• CVE-2026-21883Bokeh is an interactive visualization library written in Pyt…5.4
• CVE-2026-21884React Router is a router for React. In @remix-run/react vers…8.2
• CVE-2026-21885Miniflux 2 is an open source feed reader. Prior to version 2…6.5
• CVE-2026-21886OpenCTI is an open source platform for managing cyber threat…8.1
• CVE-2026-21888NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …7.5
• CVE-2026-21889Weblate is a web based localization tool. Prior to 5.15.2, t…7.5
• CVE-2026-2189A vulnerability was identified in itsourcecode School Manage…9.8
• CVE-2026-21891ZimaOS is a fork of CasaOS, an operating system for Zima dev…9.8
• CVE-2026-21892Parsl is a Python parallel scripting library. A SQL Injectio…7.3
• CVE-2026-21893n8n is an open source workflow automation platform. From ver…7.2