Critical severity · published Jun 4, 2026
CVE-2026-41283
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed
9.9
CVSS
0.7%
EPSS
No
On KEV
Description
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Mistral · OpenStack
20.0.0 before 20.1.1; 21.0.0; 22.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41283
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41283
github.com
https://github.com/openstack/mistral/tags
security.openstack.org
https://security.openstack.org/ossa/OSSA-2026-020.html
www.openwall.com
https://www.openwall.com/lists/oss-security/2026/06/03/14
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/06/03/14
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-41283
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2484607
More from Mistral
8.7
CVE-2026-93858
In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a…
7.2
CVE-2026-97147
In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it
7.1
CVE-2026-93860
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement
6.0
CVE-2026-93861
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming…