CVE-2026-41283: [OSSA-2026-020] OpenStack Mistral: Mistral policy enforcement bypass allows unauthorized public source cation and arbitrary code execution (CVE-2026-41283)
Last updated 6 June 2026
Other sources
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mistralto a version that resolves this vulnerability.Fixed in 15.0.0-1+deb12u1Fixed in 20.0.0-2+deb13u1 - Upgrade
Upgrade
OpenStack Mistralto a version that resolves this vulnerability.Patch OSSA-2026-020 - Compensating control
Ensure the OpenStack Mistral API is not exposed to untrusted networks (isolate or restrict access to the API endpoints that can lead to arbitrary code execution and credential exfiltration).
- Operational
Review for potential service credential exposure and rotate any OpenStack service credentials that may have been exfiltrated due to arbitrary code execution through the exposed Mistral API.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41283?
CVE-2026-41283 has a critical severity rating of 9.9.
How do I fix CVE-2026-41283?
To mitigate CVE-2026-41283, ensure that exposed API endpoints are secured and not publicly accessible.
What impact does CVE-2026-41283 have on OpenStack Mistral?
CVE-2026-41283 allows for arbitrary remote code execution which can lead to unauthorized access to service credentials.
Which versions of OpenStack are affected by CVE-2026-41283?
CVE-2026-41283 affects OpenStack Mistral versions up to and including 22.0.0.
Is arbitrary code execution possible with CVE-2026-41283?
Yes, CVE-2026-41283 allows unauthorized arbitrary code execution if the API is exposed.