GHSA-9hfw-w3f4-c4p8

OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-41283

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	mistral	>= 20.0.0, < 20.1.1	20.1.1
PyPI	mistral	21.0.0	no fix listed
PyPI	mistral	22.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-41283 advisory
https://access.redhat.com/security/cve/CVE-2026-41283 web
https://bugzilla.redhat.com/show_bug.cgi?id=2484607 web
https://github.com/openstack/mistral package
https://github.com/openstack/mistral/tags web
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41283.json web
https://security.openstack.org/ossa/OSSA-2026-020.html web
https://www.openwall.com/lists/oss-security/2026/06/03/14 web
http://www.openwall.com/lists/oss-security/2026/06/03/14 web