CVE-2026-41283

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/openstack/mistral/tags
https://security.openstack.org/ossa/OSSA-2026-020.html
https://www.openwall.com/lists/oss-security/2026/06/03/14
http://www.openwall.com/lists/oss-security/2026/06/03/14
https://access.redhat.com/security/cve/CVE-2026-41283
https://bugzilla.redhat.com/show_bug.cgi?id=2484607
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41283.json

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-04 04:17

Updated : 2026-07-22 20:10

NVD link : CVE-2026-41283

Mitre link : CVE-2026-41283

CVE.ORG link : CVE-2026-41283

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

CWE-749

Exposed Dangerous Method or Function

{"id": "CVE-2026-41283", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41283", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-04T13:09:33.475751Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "OpenStack", "product": "Mistral", "versions": [{"status": "affected", "version": "20.0.0", "lessThan": "20.1.1", "versionType": "semver"}, {"status": "affected", "version": "21.0.0", "versionType": "semver"}, {"status": "affected", "version": "22.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:openstack:16.2"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.2", "packageName": "openstack-mistral", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-06-04T04:17:12.700", "references": [{"url": "https://github.com/openstack/mistral/tags", "source": "cve@mitre.org"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-020.html", "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2026/06/03/14", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/03/14", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-41283", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484607", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41283.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-749"}]}], "descriptions": [{"lang": "en", "value": "OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials."}, {"lang": "es", "value": "OpenStack Mistral hasta la versi\u00f3n 22.0.0 permite la Ejecuci\u00f3n Remota de C\u00f3digo Arbitraria cuando la API est\u00e1 expuesta. Hay puntos finales que permiten la ejecuci\u00f3n de c\u00f3digo, lo que puede llevar a la exfiltraci\u00f3n de credenciales de servicio."}], "lastModified": "2026-07-22T20:10:00.127", "sourceIdentifier": "cve@mitre.org"}