CVE-2025-24977 is a critical (CVSS 9.1) code execution flaw in the OpenCTI threat intelligence platform. Any user holding the manage customizations capability can run commands on the host through web hook templates and read server side secrets. OpenCTI 6.4.11 fixes it, so upgrade and review who holds that capability.
What's affected
- Product: OpenCTI (Filigran, listed in NVD as Citeum OpenCTI).
- Affected: every release before 6.4.11.
- Fixed: 6.4.11 and later, per the project's GitHub advisory GHSA-mf88-g2wq-p7qm.
- Precondition: the attacker needs an account with the
manage customizationscapability, which is why the score assumes high privileges. Network access is enough otherwise, and the scope is marked as changed because the impact reaches beyond the application.
How to check if you're exposed
Start with the version. In the OpenCTI UI the version appears in the settings area, and a container deployment shows it in the image tag.
# Docker or Compose: list the running OpenCTI image tags
docker ps --format '{{.Names}} {{.Image}}' | grep -i opencti
# Kubernetes: list image tags in the namespace that runs OpenCTI
kubectl get pods -n <namespace> -o jsonpath='{range .items[*]}{.metadata.name}{" "}{.spec.containers[*].image}{"\n"}{end}'
Anything below 6.4.11 is affected. Then look at who can reach the customization settings. In the platform's roles and groups settings, list every role that includes the capability and every user in a group that holds one of those roles. Treat each name on that list as someone who could have run commands on the host until you patched.
Finally, check the web hooks themselves. Open each configured web hook and read its template field. Anything you did not write or do not recognise deserves a closer look, and so does any web hook created recently by an account that has no reason to build integrations.
What to do now
- Upgrade OpenCTI to 6.4.11 or later in every environment, including staging and any lab copies that hold real data.
- Review roles and groups, and remove the
manage customizationscapability from anyone who does not need it. Keep the list short and named. - Read every existing web hook template and compare it with what your team set up on purpose.
- Rotate secrets that are passed to the OpenCTI container as environment variables, such as database passwords, API tokens and connector keys, if an untrusted account ever held the capability. The advisory notes that these variables were reachable from web hook code.
- Check container and host logs for unexpected processes or outbound connections from the OpenCTI container during the exposure window.
- Run the container as a non root user where your deployment allows it, and limit what its network can reach, so a future flaw has a smaller blast radius.
Why it matters
The weakness is code injection. OpenCTI lets users customise web hook messages with JavaScript, and the default install ships Microsoft Teams examples built that way. According to the advisory, a guard was added to stop the template code from loading outside modules, but it could be bypassed. The result was command execution in the environment that runs OpenCTI.
- CWE-94 is improper control of code generation. The application builds or evaluates code from input it does not fully control.
The advisory spells out why this reaches past the application. Containerised deployments commonly pass secrets in through environment variables, and those variables were readable from web hook code. The person using the flaw also ends up with a root shell inside the container, which opens the surrounding infrastructure to further attacks. Because OpenCTI often stores sensitive threat intelligence and holds keys to connectors, a platform that sits at the center of a security team's tooling is worth protecting. The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
A privileged-user flaw like this one ranks very differently from an anonymous one. This demo shows how exploitability context changes what you fix first.
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need a login to use CVE-2025-24977?
Yes. The attacker needs an account with the manage customizations capability, which is why the privileges required value is high in the score. Treat that capability as close to host access until you upgrade.
Which version fixes it?
OpenCTI 6.4.11 fixes it, according to the project's advisory. Anything earlier is affected.
Sources
Last reviewed: 19 October 2026.
