CVE-2026-21887

Executive Summary

CVE-2026-21887 is a Server-Side Request Forgery (SSRF) vulnerability in the OpenCTI platform, an open-source cyber threat intelligence (CTI) knowledge management system. The flaw resides in the data ingestion feature, which accepts user-supplied URLs without validation. The application uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true), allowing attackers to craft requests to arbitrary endpoints, including internal services. This results in a semi-blind SSRF, where responses may not be fully visible but can still impact internal systems. The vulnerability is fixed in version 6.8.16.

Supply Chain & Package Security

This vulnerability is in the OpenCTI platform, which is a Node.js application. The issue stems from the use of the Axios HTTP client library with insecure default settings. While the library itself is not vulnerable, the application’s configuration and lack of input validation create the attack vector. Organizations using OpenCTI should verify their deployment version and ensure no malicious packages have been introduced via the supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (semi-blind, limited data exfiltration)
• Integrity Impact: Low (potential to modify internal state)
• Availability Impact: High (can cause denial of service to internal services)

Threat Level: High. The vulnerability is remotely exploitable without authentication, and while it is semi-blind, it can be used to probe internal networks, interact with internal services, and potentially cause availability impacts.

Deep Dive & Mechanics

The vulnerability is a classic SSRF caused by insufficient input validation in the data ingestion feature of OpenCTI. The application accepts a URL from the user and passes it directly to the Axios HTTP client. By default, Axios allows absolute URLs (allowAbsoluteUrls: true), meaning if a user provides a URL like http://169.254.169.254/latest/meta-data/, Axios will make a request to that internal endpoint.

The attack flow:

1. An attacker sends a crafted request to the OpenCTI data ingestion endpoint with a malicious URL pointing to an internal service (e.g., http://127.0.0.1:8080/admin).
2. OpenCTI passes this URL to Axios without validation.
3. Axios makes an HTTP request to the internal service.
4. The response may not be fully returned to the attacker (semi-blind), but the request itself can trigger actions on internal systems (e.g., modifying configurations, triggering backups, or causing denial of service).

The vulnerability is semi-blind because the response from the internal service may be processed by OpenCTI but not fully exposed to the attacker. However, the attacker can infer success or failure based on timing, error messages, or side effects.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 6.8.16):

// In data ingestion module
const axios = require('axios');

async function ingestData(url) {
    // No validation of the URL
    const response = await axios.get(url); // allowAbsoluteUrls defaults to true
    // Process response...
}

Patched Code (6.8.16):

const axios = require('axios');
const { URL } = require('url');

async function ingestData(url) {
    // Validate the URL
    const parsedUrl = new URL(url);
    if (parsedUrl.hostname === 'localhost' || parsedUrl.hostname === '127.0.0.1' || parsedUrl.hostname.startsWith('10.') || parsedUrl.hostname.startsWith('192.168.')) {
        throw new Error('URL points to internal network');
    }
    // Also consider using a whitelist of allowed domains
    const response = await axios.get(url, { allowAbsoluteUrls: false }); // Disable absolute URLs
    // Process response...
}

The patch adds URL validation to block requests to internal IP ranges and disables absolute URLs in Axios configuration.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable OpenCTI instance (version < 6.8.16) in a Docker container.
2. Set up an internal service (e.g., a simple HTTP server on port 8080) to simulate an internal endpoint.
3. Use the following Python script to exploit the SSRF:

import requests

target_url = "http://victim-opencti:8080/api/ingest"
internal_service = "http://127.0.0.1:8080/admin"

payload = {
    "url": internal_service
}

response = requests.post(target_url, json=payload)
print(response.text)

Exploitation Steps:

1. Identify the data ingestion endpoint (e.g., /api/ingest).
2. Craft a POST request with a JSON body containing a url field pointing to an internal service.
3. Observe the response or side effects (e.g., logs, service crashes).

Blue Team

Detection:

• Monitor for outbound HTTP requests from the OpenCTI server to internal IP addresses (127.0.0.1, 10.x.x.x, 192.168.x.x, 172.16-31.x.x).
• Look for unusual patterns in the data ingestion logs, such as requests to non-standard ports or internal hostnames.
• Use network segmentation to limit the impact of SSRF.

Hunting:

• Search for logs containing URLs with internal IPs or hostnames.
• Check for unexpected HTTP requests from the OpenCTI process to internal services.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from OpenCTI to internal IP addresses (e.g., 127.0.0.1, 10.0.0.1, 192.168.1.1).
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254).
  • Unusual User-Agent strings in internal requests (default Axios User-Agent).

• File IOCs:

  • Log entries in OpenCTI logs showing URLs with internal IPs.
  • Modified configuration files if the attacker exploited the SSRF to change settings.

• Behavioral IOCs:

  • Unexpected latency in data ingestion due to requests to slow internal services.
  • Error messages related to connection timeouts or refused connections to internal services.

Detection Engineering

YARA Rule

rule CVE_2026_21887_SSRF_OpenCTI {
    meta:
        description = "Detects SSRF attempts against OpenCTI data ingestion"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-21887"
    strings:
        $url_pattern = /(http|https):\/\/(127\.0\.0\.1|localhost|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
        $ingest_endpoint = "/api/ingest"
    condition:
        $url_pattern and $ingest_endpoint
}

Sigma Rule

title: OpenCTI SSRF Attempt via Data Ingestion
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2026-21887 by sending requests to internal IPs
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: opencti
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/ingest'
        cs-uri-query|contains: 
            - '127.0.0.1'
            - 'localhost'
            - '10.'
            - '192.168.'
            - '169.254.'
    condition: selection
falsepositives:
    - Legitimate internal monitoring tools
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-21887 OpenCTI SSRF Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/ingest"; http_uri; content:"url"; http_client_body; pcre:"/(127\.0\.0\.1|localhost|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCTI to version 6.8.16 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests to internal IPs in the data ingestion endpoint.
3. Restrict outbound network access from the OpenCTI server to only necessary external services.

Long-term Fixes:

• Apply input validation to all user-supplied URLs, including a whitelist of allowed domains.
• Disable absolute URLs in Axios configuration (allowAbsoluteUrls: false).
• Implement network segmentation to limit the blast radius of SSRF vulnerabilities.
• Regularly update dependencies and monitor for security advisories.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.