9.9
Critical
CVE-2026-41283 OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed
Description
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Mistral | 22.0.0 | No fix stated |
| Mistral | 21.0.0 | No fix stated |
| Mistral 20.0 | 20.0.0 → < 20.1.1 | 20.1.1 |
| Red Hat OpenStack Platform 16.2 | Versions not published |
Other CVEs of Mistral
The 5 CVEs of Mistral →
CVE-2026-97147
In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can…
7.2
High
CVE-2026-93861
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another…
6.0
Medium
CVE-2026-93860
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the…
7.1
High
CVE-2026-93858
In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to…
8.7
High