openstack/mistral · Security
OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed
- GHSA ID
- GHSA-9hfw-w3f4-c4p8
- CVE ID
- CVE-2026-41283
- Severity
- critical
- Published
- Updated
- CVSS
- 9.9 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS v3
- 9.9 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Description
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
CWEs
- CWE-749 · Exposed Dangerous Method or Function
- CWE-863 · Incorrect Authorization
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-41283 ↗
- https://github.com/openstack/mistral/tags ↗
- https://www.openwall.com/lists/oss-security/2026/06/03/14 ↗
- http://www.openwall.com/lists/oss-security/2026/06/03/14 ↗
- https://security.openstack.org/ossa/OSSA-2026-020.html ↗
- https://access.redhat.com/security/cve/CVE-2026-41283 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2484607 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41283.json ↗
- https://github.com/advisories/GHSA-9hfw-w3f4-c4p8 ↗