CVE-2026-27960 json
OpenCTI privilege escalation and unauthenticated access via default admin account
published 2026-05-05 6 mo ago modified 2026-07-25 3 mo ago also EUVD-2026-27420 , GHSA-6vvv-vmfr-xhrx , PYSEC-2026-119
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.1%
- EPSS 7.1% chance of exploitation in 30 days, percentile 94%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disabled using the `APP__ADMIN__EXTERNALLY_MANAGED` configuration.
Patch / fix
- pypi pycti 6.9.13
- citeum opencti 6.9.13
Timeline
- First public exploit (Metasploit exploit/linux/http/opencti_notifier_rce)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
7.09% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/opencti_notifier_rce OpenCTI Authentication Bypass and Notifier EJS Remote Code Execution metasploit exploit, excellent rank, 2026-05-04
- Nuclei template OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pycti | >=6.9.0, <6.9.13 |
6.9.13 |
Affected products
- OpenCTI-Platform opencti
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/OpenCTI-Platform/opencti/security/advisories/GHSA-6vvv-vmfr-xhrx
mitigation, vendor-advisory, advisory
Sources
- CVE List CVE-2026-27960
- NVD CVE-2026-27960
- OSV PYSEC-2026-119
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.