CVE-2026-41283

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-41283", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-07-15T00:59:37.963Z", "dateReserved": "2026-04-20T00:00:00.000Z", "datePublished": "2026-06-04T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mistral", "vendor": "OpenStack", "versions": [{"lessThan": "20.1.1", "status": "affected", "version": "20.0.0", "versionType": "semver"}, {"status": "affected", "version": "21.0.0", "versionType": "semver"}, {"status": "affected", "version": "22.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-06-04T14:58:52.365Z"}, "references": [{"url": "https://github.com/openstack/mistral/tags"}, {"url": "https://www.openwall.com/lists/oss-security/2026/06/03/14"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-020.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/03/14"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-04T05:40:27.729Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T13:09:33.475751Z", "id": "CVE-2026-41283", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T13:09:41.868Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:16.2"], "defaultStatus": "unaffected", "packageName": "openstack-mistral", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat"}], "datePublic": "2026-06-04T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A flaw was found in OpenStack Mistral. When the API is exposed, a remote attacker can exploit certain endpoints to achieve arbitrary code execution. This allows the attacker to run malicious code on the system and potentially exfiltrate sensitive service credentials."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-749", "description": "Exposed Dangerous Method or Function", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-41283"}, {"name": "RHBZ#2484607", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484607"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41283.json"}], "timeline": [{"lang": "en", "time": "2026-06-04T04:01:02.052Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-04T00:00:00.000Z", "value": "Made public."}], "title": "openstack-mistral: OpenStack Mistral: Arbitrary Remote Code Execution via exposed API endpoints", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T00:59:37.963Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/03/14"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-04T05:40:27.729Z"}}, {"title": "openstack-mistral: OpenStack Mistral: Arbitrary Remote Code Execution via exposed API endpoints", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:openstack:16.2"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.2", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-06-04T04:01:02.052Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-04T00:00:00.000Z", "value": "Made public."}], "x_adpType": "supplier", "datePublic": "2026-06-04T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-41283", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484607", "name": "RHBZ#2484607", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41283.json", "tags": ["x_sadp-csaf-vex"]}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in OpenStack Mistral. When the API is exposed, a remote attacker can exploit certain endpoints to achieve arbitrary code execution. This allows the attacker to run malicious code on the system and potentially exfiltrate sensitive service credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-749", "description": "Exposed Dangerous Method or Function"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-08T12:05:51.328Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41283", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-04T13:09:33.475751Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T13:09:37.654Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenStack", "product": "Mistral", "versions": [{"status": "affected", "version": "20.0.0", "lessThan": "20.1.1", "versionType": "semver"}, {"status": "affected", "version": "21.0.0", "versionType": "semver"}, {"status": "affected", "version": "22.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/openstack/mistral/tags"}, {"url": "https://www.openwall.com/lists/oss-security/2026/06/03/14"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-020.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-06-04T14:58:52.365Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41283", "state": "PUBLISHED", "dateUpdated": "2026-07-08T12:05:51.328Z", "dateReserved": "2026-04-20T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-06-04T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mistral", "vendor": "OpenStack", "versions": [{"lessThan": "20.1.1", "status": "affected", "version": "20.0.0", "versionType": "semver"}, {"status": "affected", "version": "21.0.0", "versionType": "semver"}, {"status": "affected", "version": "22.0.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:16.2"], "defaultStatus": "unaffected", "packageName": "openstack-mistral", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials."}, {"lang": "es", "value": "OpenStack Mistral hasta la versi\u00f3n 22.0.0 permite la Ejecuci\u00f3n Remota de C\u00f3digo Arbitraria cuando la API est\u00e1 expuesta. Hay puntos finales que permiten la ejecuci\u00f3n de c\u00f3digo, lo que puede llevar a la exfiltraci\u00f3n de credenciales de servicio."}], "id": "CVE-2026-41283", "lastModified": "2026-07-22T20:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41283", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-04T13:09:33.475751Z", "version": "2.0.3"}}]}, "published": "2026-06-04T04:17:12.700", "references": [{"source": "cve@mitre.org", "url": "https://github.com/openstack/mistral/tags"}, {"source": "cve@mitre.org", "url": "https://security.openstack.org/ossa/OSSA-2026-020.html"}, {"source": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2026/06/03/14"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/06/03/14"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-41283"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484607"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41283.json"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cve@mitre.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-749"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "openstack-mistral: OpenStack Mistral: Arbitrary Remote Code Execution via exposed API endpoints", "id": "2484607", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484607"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-749", "details": ["OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.", "A flaw was found in OpenStack Mistral. When the API is exposed, a remote attacker can exploit certain endpoints to achieve arbitrary code execution. This allows the attacker to run malicious code on the system and potentially exfiltrate sensitive service credentials."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the OpenStack Mistral API to trusted internal networks or hosts. Configure firewall rules to limit inbound connections to the Mistral API port (typically 8989) from untrusted sources, ensuring the API is not exposed to the public internet.\nExample using `firewall-cmd` (adjust zones and ports as needed):\n`firewall-cmd --zone=public --remove-port=8989/tcp --permanent`\n`firewall-cmd --zone=internal --add-port=8989/tcp --permanent`\n`firewall-cmd --reload`\nThis action may impact legitimate clients requiring external access to the Mistral API. A service reload or restart may be required for firewall changes to take full effect."}, "name": "CVE-2026-41283", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "openstack-mistral", "product_name": "Red Hat OpenStack Platform 16.2"}], "public_date": "2026-06-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-41283\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41283\nhttps://github.com/openstack/mistral/tags\nhttps://www.openwall.com/lists/oss-security/2026/06/03/14"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[20.0.0,20.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "21.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "22.0.0"}}], "original": {"product": "Mistral", "source": "cna", "vendor": "OpenStack"}, "product": "mistral", "vendor": "openstack"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[20.0.0,20.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "21.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "22.0.0"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "Mistral", "source": "cna", "vendor": "OpenStack"}, "product": "openstack-mistral", "vendor": "redhat"}], "created": "2026-06-04T06:00:08.584317+00:00", "updated": "2026-06-11T02:30:02.695312+00:00", "vendors": ["openstack", "openstack$PRODUCT$mistral", "redhat", "redhat$PRODUCT$openstack-mistral"]}