Introduction
An authentication bypass in OpenCTI's API lets any unauthenticated remote attacker impersonate existing users, including the default administrator, and run arbitrary API queries with their full privileges. For organizations that use OpenCTI to manage sensitive cyber threat intelligence, this vulnerability exposes the entire knowledge base, all observables, and the platform configuration to unauthorized access and manipulation.
OpenCTI is an open source cyber threat intelligence platform developed by Filigran. Security teams use it to structure, store, and operationalize threat intelligence data. It is widely adopted across government agencies, MSSPs, and enterprise SOCs as a central hub for CTI workflows, and it integrates with tools like MISP, TheHive, and various SIEM platforms. Because it holds sensitive threat data and indicators of compromise, an authentication bypass in OpenCTI is especially serious.
Technical Information
The root cause of CVE-2026-27960 is an Improper Authentication weakness (CWE-287) in the OpenCTI API. Unauthenticated attackers can bypass the platform's authentication entirely and run API queries in the context of any user that exists in the system. Standard installations have the default admin account active, and in that case an attacker can trivially escalate to full administrative control over the whole platform.
CVSS Breakdown
The CVSS v3.1 vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which gives a score of 9.8 Critical. The metrics break down as follows:
| Metric | Value | Implication |
|---|---|---|
| Attack Vector (AV) | Network | Exploitable remotely |
| Attack Complexity (AC) | Low | No special conditions required |
| Privileges Required (PR) | None | Unauthenticated access |
| User Interaction (UI) | None | Automated exploitation possible |
| Confidentiality (C) | High | Full data exposure |
| Integrity (I) | High | Data manipulation possible |
| Availability (A) | High | Service disruption possible |
Attack Flow
Based on the advisory details, exploitation generally follows this sequence:
- An attacker finds a network-accessible OpenCTI instance running a vulnerable version (6.6.0 through 6.9.12).
- The attacker sends crafted, unauthenticated API requests that exploit the authentication bypass to impersonate an existing user.
- By targeting the default admin account, the attacker gets full read and write access to all threat intelligence data, platform configuration, user management, and any integrated feeds or connectors.
- With administrative API access, the attacker can exfiltrate sensitive threat intelligence, modify or delete observables and indicators, create new accounts for persistence, or disrupt platform operations entirely.
The vulnerability needs no authentication, has low complexity, and requires no user interaction, so it is well suited to automated scanning and exploitation at scale.
Mitigation
The only complete fix is to upgrade OpenCTI to version 6.9.13 or later.
As an interim measure, administrators can disable the default admin account by setting the APP__ADMIN__EXTERNALLY_MANAGED configuration option. The official advisory states that this is only a partial workaround. The underlying authentication bypass remains, and attackers can still impersonate other user accounts in the system. Administrators should check their configuration after applying the workaround and treat the upgrade as the definitive fix.
Affected Systems and Versions
The vulnerability affects OpenCTI versions greater than or equal to 6.6.0 and less than 6.9.13:
- Vulnerable range: versions 6.6.0 through 6.9.12
- Fixed version: 6.9.13
Any OpenCTI deployment in the vulnerable range that exposes its API to the network is at risk. Instances with the default admin account enabled (the default configuration) face the highest risk of full platform compromise.
