CVE-2025-26621— OpenCTI vulnerable to Denial of Service through web hook
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-26621
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenCTI vulnerable to Denial of Service through web hook
Source: CVE Program / CVE List V5
Vulnerability Description
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype pollution, making the node js server running the OpenCTI frontend become unavailable. Version 6.5.2 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
OpenCTI 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenCTI是OpenCTI开源的一个开放网络威胁情报平台。 OpenCTI 6.5.2之前版本存在代码注入漏洞，该漏洞源于用户可编辑执行JavaScript代码的Webhook，可能导致拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OpenCTI-Platform | opencti | < 6.5.2 | - |
II. Public POCs for CVE-2025-26621
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7142 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2025-26621
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: opencti
- CVE-2026-35211
OpenCTI: Elasticsearch Painless Script Injection via GraphQL - CVE-2026-35210
OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP - CVE-2026-35212
OpenCTI has XSS in the rendering of email-message observable - CVE-2026-44730
OpenCTI: Privilege escalation via graphQL API abusable by or - CVE-2026-27960
OpenCTI privilege escalation and unauthenticated access via
Same vendor: OpenCTI-Platform
- CVE-2026-35211
OpenCTI: Elasticsearch Painless Script Injection via GraphQL - CVE-2026-35210
OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP - CVE-2026-35212
OpenCTI has XSS in the rendering of email-message observable - CVE-2026-44730
OpenCTI: Privilege escalation via graphQL API abusable by or - CVE-2026-27960
OpenCTI privilege escalation and unauthenticated access via
Same weakness: CWE-94
- CVE-2026-46409
OpenYak local API: unauthenticated CSRF chain leads to Remot - CVE-2026-17603
Nexus Repository 3 - HikariCP connectionInitSql Injection RC - CVE-2026-48054
OpenZeppelin Contracts Wizard has Code Injection in Generate - CVE-2026-45572
Decidim: HTML content blocks allow stored script execution - CVE-2026-50159
Mermaid allows CSS injection applying to sibling elements of
V. Comments for CVE-2025-26621
No comments yet