CVE-2026-35210

Executive Summary

CVE-2026-35210 is an authorization bypass vulnerability in OpenCTI, an open-source platform for managing cyber threat intelligence (CTI) knowledge and observables. The flaw allows any authenticated user with the KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting a synchronized-upsert: true HTTP header. This enables attackers to downgrade confidence levels, remove security markings (e.g., TLP:RED), manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports. The vulnerability has a CVSS score of 7.1 (High) and is fixed in version 7.260326.0. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

OpenCTI is distributed as a Docker image and via GitHub releases. The vulnerability is in the core application logic, not in a specific package manager (NPM, PyPI, Go, Ruby). However, organizations using OpenCTI should verify the integrity of their deployment and ensure they are not running a forked or modified version that may not have the patch.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user with KNOWLEDGE_KNUPDATE permission
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited information disclosure via manipulated markings
• Integrity Impact: High (I:H) – ability to downgrade confidence, remove markings, and manipulate relationships
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability allows an authenticated attacker to bypass critical security controls, potentially undermining the trustworthiness of CTI data.

Deep Dive & Mechanics

The vulnerability resides in the STIX entity upsert (insert or update) mechanism. OpenCTI uses a synchronized-upsert HTTP header to indicate that an incoming STIX object should be processed as a bulk synchronization operation, which historically had relaxed validation for performance reasons. The flaw is that the server does not properly re-validate the user's permissions and object marking constraints when this header is present.

Attack Flow:

1. An attacker authenticates to OpenCTI with a user account that has KNOWLEDGE_KNUPDATE permission.
2. The attacker crafts a POST/PUT request to the STIX entity endpoint (e.g., /api/stix/upsert) with the header synchronized-upsert: true.
3. The request body contains a STIX object (e.g., an Indicator) with modified confidence level (e.g., set to 0) and/or removed object markings (e.g., no TLP:RED).
4. The server processes the request without enforcing the usual confidence level validation or object marking restrictions, allowing the attacker to downgrade the data.

Impacted STIX Types: Indicators, ThreatActors, Malware, Reports, and any other STIX 2.1 object type that supports confidence and markings.

Vulnerable vs. Patched Code

Vulnerable Code (before 7.260326.0): The vulnerable code likely exists in the STIX upsert handler, where the synchronized-upsert header bypasses the permission and marking checks. A simplified pseudocode representation:

def handle_stix_upsert(request):
    if request.headers.get('synchronized-upsert') == 'true':
        # Bypass validation for performance
        stix_object = parse_stix(request.body)
        upsert_stix_object(stix_object)
    else:
        # Normal validation
        validate_user_permissions(request.user)
        validate_confidence(request.user, request.body)
        validate_markings(request.user, request.body)
        stix_object = parse_stix(request.body)
        upsert_stix_object(stix_object)

Patched Code (7.260326.0): The patched version removes the bypass or adds explicit permission checks even when the header is present:

def handle_stix_upsert(request):
    stix_object = parse_stix(request.body)
    # Always validate regardless of header
    validate_user_permissions(request.user)
    validate_confidence(request.user, stix_object)
    validate_markings(request.user, stix_object)
    upsert_stix_object(stix_object)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an OpenCTI instance (version < 7.260326.0)
• Valid credentials for a user with KNOWLEDGE_KNUPDATE permission

Exploitation Steps:

1. Identify the STIX upsert endpoint (typically /api/stix/upsert or similar).
2. Craft a request to modify an existing Indicator:

   curl -X POST "https://target.opencti.local/api/stix/upsert" \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -H "synchronized-upsert: true" \
     -d '{
       "type": "indicator",
       "id": "indicator--<existing-id>",
       "confidence": 0,
       "object_marking_refs": [],
       "pattern": "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']"
     }'
   

3. Verify the change by querying the indicator via the API or UI.

Expected Outcome: The indicator's confidence is set to 0 and all object markings are removed, potentially causing it to be ignored by downstream systems or analysts.

Blue Team

Detection:

• Monitor API logs for requests containing the synchronized-upsert: true header from non-admin users.
• Alert on any upsert operations that modify confidence levels or object markings on existing entities without proper authorization.

Hunting:

• Search for STIX objects with confidence = 0 or missing object markings that previously had them.
• Review audit logs for bulk upsert operations performed by users with only KNOWLEDGE_KNUPDATE permission.

Mitigation:

• Immediately upgrade to OpenCTI 7.260326.0 or later.
• If upgrade is not possible, restrict the KNOWLEDGE_KNUPDATE permission to trusted users only.
• Implement a WAF rule to block requests with the synchronized-upsert header from non-whitelisted IPs.

Indicators of Compromise (IOCs)

• HTTP Header: synchronized-upsert: true in requests to STIX upsert endpoints.
• API Endpoint: /api/stix/upsert or similar upsert paths.
• Modified STIX Objects: Indicators, ThreatActors, Malware, Reports with confidence = 0 or missing object markings.
• Audit Log Entries: Bulk upsert operations from users with KNOWLEDGE_KNUPDATE permission.

Detection Engineering

YARA Rule

rule detect_opencti_synchronized_upsert_bypass {
    meta:
        description = "Detects HTTP requests with synchronized-upsert header targeting OpenCTI"
        author = "Valters IT"
        date = "2026-03-26"
        reference = "CVE-2026-35210"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $header = "synchronized-upsert: true" nocase
        $endpoint = "/api/stix/upsert" nocase
    condition:
        $header and $endpoint
}

Sigma Rule

title: OpenCTI Authorization Bypass via synchronized-upsert Header
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with the synchronized-upsert header targeting OpenCTI STIX upsert endpoints, indicating potential exploitation of CVE-2026-35210.
author: Valters IT
date: 2026-03-26
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-35210
logsource:
    category: webserver
    product: opencti
detection:
    selection:
        http.request.headers|contains: 'synchronized-upsert: true'
        http.request.uri|contains: '/api/stix/upsert'
    condition: selection
falsepositives:
    - Legitimate synchronization operations from trusted sources
level: high
tags:
    - attack.t1190
    - cve.2026.35210

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2026-35210 - OpenCTI Authorization Bypass via synchronized-upsert Header";
    flow:to_server;
    content:"synchronized-upsert: true"; http_header;
    content:"/api/stix/upsert"; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2026-35210;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCTI to version 7.260326.0 or later.
2. If upgrade is not possible, restrict KNOWLEDGE_KNUPDATE permission to only highly trusted users.
3. Implement network-level controls to block the synchronized-upsert header from untrusted sources.

Long-term Measures:

• Conduct a security review of all upsert and bulk operations in OpenCTI.
• Implement additional logging and monitoring for STIX object modifications.
• Regularly audit user permissions and remove unnecessary privileges.

Workaround:

• Use a reverse proxy (e.g., Nginx) to strip the synchronized-upsert header from incoming requests:

  location /api/stix/upsert {
      proxy_set_header synchronized-upsert "";
      proxy_pass http://backend;
  }
  

Valters IT
Securing your digital frontier.