OpenCTI’s GraphQL API contains a script filter operator that forwards user‑supplied Elasticsearch Painless scripts directly into search queries without validation. An authenticated user with the KNOWLEDGE capability can submit any script, including those that are computationally expensive. Executing such scripts drains Elasticsearch cluster CPU resources and can degrade performance or result in a denial of service for all users. The description does not indicate that the scripts could read or exfiltrate data from the OpenCTI database.

All OpenCTI Platform releases prior to 7.260401.0 are affected. Users with the KNOWLEDGE role in any of those versions can trigger the flaw. Version 7.260401.0 and later eliminate the vulnerable script filter operator.

The CVSS score of 6.5 classifies the vulnerability as moderate severity, while the EPSS score of <1% implies a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers need only authentication and the KNOWLEDGE capability; they can send malicious scripts that overload the cluster, causing performance degradation or a service outage.