CVE-2026-35211

Executive Summary

CVE-2026-35211 is a high-severity vulnerability in OpenCTI, an open-source platform for managing cyber threat intelligence. The flaw resides in the GraphQL API, where the FilterOperator enum exposes an unvalidated script operator. This allows any authenticated user with the KNOWLEDGE capability to inject arbitrary Elasticsearch Painless scripts into search queries. An attacker can exploit this to execute computationally expensive scripts, consuming cluster CPU resources and causing a denial of service (DoS) for all users. The vulnerability is unpatched in versions prior to 7.260401.0, and no public proof-of-concept (PoC) or exploit code is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the potential for resource exhaustion.

Supply Chain & Package Security

OpenCTI is distributed as a Docker image and via GitHub releases. The vulnerability affects the core application logic, not a specific package manager. Users should verify the integrity of their OpenCTI installation by checking the version and applying the patch from the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with KNOWLEDGE capability)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability is classified as a denial-of-service (DoS) threat. While it requires authentication, the low complexity and network accessibility make it a viable attack vector for resource exhaustion.

Deep Dive & Mechanics

The OpenCTI GraphQL API uses Elasticsearch as its search backend. The FilterOperator enum includes a script operator that allows users to pass custom Painless scripts for advanced filtering. In vulnerable versions, this input is not sanitized or validated, enabling an attacker to inject arbitrary Painless code.

How it works:

1. An authenticated user sends a GraphQL query with a filter that uses the script operator.
2. The script operator accepts a script field containing Painless code.
3. The backend passes this script directly to Elasticsearch without validation.
4. Elasticsearch executes the script, which can include computationally expensive operations (e.g., infinite loops, heavy calculations).
5. The script consumes CPU resources, degrading or denying service to other users.

Impact: The attack targets the Elasticsearch cluster, not the OpenCTI application itself. However, since OpenCTI relies on Elasticsearch for all search functionality, a successful attack can render the platform unusable.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 7.260401.0):

# Example of vulnerable GraphQL resolver
def resolve_filters(self, info, filters):
    for filter in filters:
        if filter.operator == 'script':
            # No validation or sanitization
            script = filter.script
            # Directly passed to Elasticsearch
            query = {"script": {"source": script}}
            # Execute query

Patched Code (version 7.260401.0):

# Example of patched GraphQL resolver
def resolve_filters(self, info, filters):
    for filter in filters:
        if filter.operator == 'script':
            # Validate and sanitize script
            script = filter.script
            if not is_safe_script(script):
                raise ValueError("Unsafe script detected")
            # Use a sandboxed execution context
            query = {"script": {"source": script, "lang": "painless"}}
            # Execute query with resource limits

The patch introduces input validation and resource limits to prevent abuse.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to an OpenCTI instance (version < 7.260401.0)
• Valid credentials with KNOWLEDGE capability
• Network access to the GraphQL endpoint (typically /graphql)

Exploitation Steps:

1. Authenticate to the OpenCTI GraphQL API.
2. Craft a malicious query that uses the script operator with a computationally expensive Painless script.
3. Send the query repeatedly to exhaust Elasticsearch CPU resources.

Example GraphQL Mutation:

mutation {
  stixDomainObjects(
    filters: [
      {
        key: "name",
        values: ["test"],
        operator: "script",
        script: "while (true) { }"  # Infinite loop
      }
    ]
  ) {
    edges {
      node {
        id
      }
    }
  }
}

Note: This is a conceptual example. No public exploit code is available.

Blue Team (Defense & Detection)

Detection:

• Monitor Elasticsearch cluster CPU usage for unusual spikes.
• Log and alert on GraphQL queries using the script operator.
• Analyze Painless script content for suspicious patterns (e.g., infinite loops, heavy computations).

Mitigation:

• Upgrade to OpenCTI version 7.260401.0 or later.
• Implement rate limiting on GraphQL queries.
• Restrict the script operator to trusted users only.
• Use Elasticsearch resource limits (e.g., script.max_compilations_rate).

Indicators of Compromise (IOCs)

• Network: GraphQL queries containing the script operator with unusual Painless code.
• Logs: Elasticsearch logs showing high script compilation rates or execution times.
• System: Elevated CPU usage on Elasticsearch nodes.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2026_35211_OpenCTI_Script_Injection {
    meta:
        description = "Detects GraphQL queries with script operator in OpenCTI"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35211"
    strings:
        $graphql_script = /"operator"\s*:\s*"script"/ nocase
        $painless_code = /"script"\s*:\s*"[^"]*"/ nocase
    condition:
        $graphql_script and $painless_code
}

Sigma Rule

title: OpenCTI GraphQL Script Operator Abuse
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2026-35211 by using the script operator in GraphQL queries
author: Valters IT
date: 2026-01-01
logsource:
    category: application
    product: opencti
detection:
    selection:
        query|contains: '"operator": "script"'
    condition: selection
falsepositives:
    - Legitimate use of script operator by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-35211 OpenCTI GraphQL Script Injection"; flow:to_server; content:"\"operator\": \"script\""; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCTI to version 7.260401.0 or later.
2. If upgrade is not possible, disable the script operator in the GraphQL schema.
3. Implement network segmentation to limit access to the GraphQL endpoint.

Long-term Measures:

• Regularly update OpenCTI and Elasticsearch.
• Monitor for unusual GraphQL queries.
• Conduct security audits of GraphQL resolvers.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests containing "operator": "script" in the body.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert