CVE-2026-35211

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 7.260401.0

Description The GraphQL API exposes a script filter operator within its FilterOperator enum. This allows authenticated users with the KNOWLEDGE capability to submit Elasticsearch Painless script values into search queries without proper validation or sanitization. An attacker can use this to execute computationally expensive scripts that consume cluster CPU resources, leading to service degradation or a denial of service for all users. Painless is a secure, fast scripting language designed specifically for Elasticsearch.

Recommendations Update to version 7.260401.0.