CVE-2026-93858: [OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147))
In OpenStack Mistral through 23.0.0, the std.sshproxied action passes a caller-supplied proxycommand value directly to paramiko.ProxyCommand() before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an arbitrary local command as proxycommand; paramiko starts that command as a subprocess on the executor host under the executor's own service account, independent of whether the SSH connection itself ever succeeds. Only Mistral deployments that permit the std.sshproxied action, the default configuration, are affected.
Affected Software
Event History
Frequently Asked Questions
Who can trigger this behavior?
An authenticated Mistral project member who can use the standard action-execution API can submit a proxy_command value.
Does exploitation depend on successfully connecting to the SSH gateway or target?
No. The supplied command is started as a local subprocess before any SSH connection attempt, so the SSH connection does not need to succeed.
Which account runs the supplied command, and are default deployments affected?
The command runs on the executor host under the Mistral executor service account. Deployments that permit std.ssh_proxied are affected, and this is the default configuration.