9.9
Critique
CVE-2026-41283 OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed
Description
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Mistral | 22.0.0 | Pas de correctif indiqué |
| Mistral | 21.0.0 | Pas de correctif indiqué |
| Mistral 20.0 | 20.0.0 → < 20.1.1 | 20.1.1 |
| Red Hat OpenStack Platform 16.2 | Versions non publiées |
Références
- github.com github.com
- www.openwall.com www.openwall.com
- security.openstack.org security.openstack.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Mistral
Les 5 CVE de Mistral →
CVE-2026-97147
In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can…
7.2
Élevée
CVE-2026-93861
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another…
6.0
Moyenne
CVE-2026-93860
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the…
7.1
Élevée
CVE-2026-93858
In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to…
8.7
Élevée