Paper/Archive/CVE-2026-41283

CVE-2026-41283

OpenStack Mistral — OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed.

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 54.4.544 × 2010.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

Affected

ProductAffectedFixed inSource

Mistral20.0.0 – < 20.1.120.1.1CNA

Mistral21.0.0–CNA

Mistral22.0.0–CNA

Red Hat OpenStack Platform 16.2see advisory–redhat-SADP

Scores by source

mitre (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

redhat-SADP (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/openstack/mistral/tags refopenwall.com/lists/oss-security/2026/06/03/14 refsecurity.openstack.org/ossa/OSSA-2026-020.html refopenwall.com/lists/oss-security/2026/06/03/14 refaccess.redhat.com/security/cve/CVE-2026-41283 refbugzilla.redhat.com/show_bug.cgi?id=2484607 refsecurity.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41283.json