CVE-2026-41283
- State
- Published
- Severity
- 9.9 Critical
- Published
- Jun 4, 2026
- Updated
- Jul 15, 2026
- Reserved
- Apr 20, 2026
Description
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | mitre |
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | redhat-SADP |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
MistralOpenStack |
|
References
- https://github.com/openstack/mistral/tags
- https://www.openwall.com/lists/oss-security/2026/06/03/14
- https://security.openstack.org/ossa/OSSA-2026-020.html
- http://www.openwall.com/lists/oss-security/2026/06/03/14
- https://access.redhat.com/security/cve/CVE-2026-41283vdb-entry
- RHBZ#2484607issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41283.json
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.