CVE-2026-41283

Published: Jun 4, 2026Modified: Jul 22, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: MITRE (Secondary)

Description

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

Related CWEs

CWE-749

Exposed Dangerous Method or Function

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (7)

https://github.com/openstack/mistral/tags

Source: cve@mitre.org

https://security.openstack.org/ossa/OSSA-2026-020.html

Source: cve@mitre.org

https://www.openwall.com/lists/oss-security/2026/06/03/14

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2026/06/03/14

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/security/cve/CVE-2026-41283

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2484607

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41283.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.