Description (CNA)
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenStack / Mistral | affected 20.0.0 before 20.1.1; affected 21.0.0; affected 22.0.0 |
CWE
CWE-863
References
- https://github.com/openstack/mistral/tags
- https://www.openwall.com/lists/oss-security/2026/06/03/14
- https://security.openstack.org/ossa/OSSA-2026-020.html
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.
A flaw was found in OpenStack Mistral. When the API is exposed, a remote attacker can exploit certain endpoints to achieve arbitrary code execution. This allows the attacker to run malicious code on the system and potentially exfiltrate sensitive service credentials.