MI
Product
Mistral
5
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 1High 3Medium 1Low 0
Watch
Add Mistral to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-41283 | 9.9 | Jun 4 | OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed Affected: 20.0.0 before 20.1.1; 21.0.0; 22.0.0 |
| CVE-2026-93858 | 8.7 | Oct 8 | In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a… Affected: before 20.1.1; 21.0.0 before 21.0.1; 22.0.0 before 22.0.1; 23.0.0 |
| CVE-2026-97147 | 7.2 | Oct 8 | In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it Affected: before 20.1.1; 21.0.0 before 21.0.1; 22.0.0 before 22.0.1; 23.0.0 |
| CVE-2026-93860 | 7.1 | Oct 8 | In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement Affected: before 20.1.1; 21.0.0 before 21.0.1; 22.0.0 before 22.0.1; 23.0.0 |
| CVE-2026-93861 | 6.0 | Oct 8 | In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming… Affected: before 20.1.1; 21.0.0 before 21.0.1; 22.0.0 before 22.0.1; 23.0.0 |
Showing 5