CVE-2026-35211
OpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoS
CVSS Score
6.5
EPSS Score
0.4%
EPSS Percentile
30th
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0.
| CWE | CWE-94 CWE-863 |
| Vendor | opencti-platform |
| Product | opencti |
| Published | Jul 8, 2026 |
| Last Updated | Jul 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for opencti-platform opencti
Be the first to know when new medium vulnerabilities affecting opencti-platform opencti are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
OpenCTI-Platform / opencti
< 7.260401.0
References
github.com: https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-qpp6-p693-rmm4 github.com: https://github.com/OpenCTI-Platform/opencti/pull/15284 github.com: https://github.com/OpenCTI-Platform/opencti/commit/b134ccedf9e68386723cb42197f8e1d60c3bdbd9 github.com: https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260401.0