Log in Start free

Vulnerability · Published Jun 4, 2026 · Assigned by mitre

CVE-2026-41283

Critical 9.9

In plain English

A critical-severity incorrect authorization in Mistral from OpenStack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.7%top 45.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mistral15.0.0-1+deb12u1DEBIAN-CVE-2026-41283
Debian:13mistral20.0.0-2+deb13u1DEBIAN-CVE-2026-41283
Debian:14mistral22.0.0-3DEBIAN-CVE-2026-41283
PyPImistral20.1.1PYSEC-2026-3486
PyPImistralno fix listedPYSEC-2026-3486
PyPImistral20.1.1GHSA-9hfw-w3f4-c4p8
PyPImistralno fix listedGHSA-9hfw-w3f4-c4p8
PyPImistralno fix listedGHSA-9hfw-w3f4-c4p8
Ubuntu:22.04:LTSmistral14.0.0-0ubuntu1.1UBUNTU-CVE-2026-41283
Ubuntu:24.04:LTSmistral18.0.1-0ubuntu1.1UBUNTU-CVE-2026-41283
Ubuntu:25.10mistral21.0.0-0ubuntu1.1UBUNTU-CVE-2026-41283
Ubuntu:26.04:LTSmistral22.0.0-0ubuntu1.1UBUNTU-CVE-2026-41283
Ubuntu:26.10mistralno fix listedUBUNTU-CVE-2026-41283

Affected products (as reported)

VendorProductVersions
OpenStack Mistral 20.0.0 – before 20.1.121.0.022.0.0

Weakness: CWE-863, CWE-749 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References