{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-41283", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-06-04T14:58:52.365Z", "dateReserved": "2026-04-20T00:00:00.000Z", "datePublished": "2026-06-04T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mistral", "vendor": "OpenStack", "versions": [{"lessThan": "20.1.1", "status": "affected", "version": "20.0.0", "versionType": "semver"}, {"status": "affected", "version": "21.0.0", "versionType": "semver"}, {"status": "affected", "version": "22.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-06-04T14:58:52.365Z"}, "references": [{"url": "https://github.com/openstack/mistral/tags"}, {"url": "https://www.openwall.com/lists/oss-security/2026/06/03/14"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-020.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/03/14"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-04T05:40:27.729Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T13:09:33.475751Z", "id": "CVE-2026-41283", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T13:09:41.868Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/03/14"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-04T05:40:27.729Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41283", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-04T13:09:33.475751Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T13:09:37.654Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenStack", "product": "Mistral", "versions": [{"status": "affected", "version": "20.0.0", "lessThan": "20.1.1", "versionType": "semver"}, {"status": "affected", "version": "21.0.0", "versionType": "semver"}, {"status": "affected", "version": "22.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/openstack/mistral/tags"}, {"url": "https://www.openwall.com/lists/oss-security/2026/06/03/14"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-020.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-06-04T14:58:52.365Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41283", "state": "PUBLISHED", "dateUpdated": "2026-06-04T14:58:52.365Z", "dateReserved": "2026-04-20T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-06-04T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials."}], "id": "CVE-2026-41283", "lastModified": "2026-06-04T16:21:06.820", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2026-06-04T04:17:12.700", "references": [{"source": "cve@mitre.org", "url": "https://github.com/openstack/mistral/tags"}, {"source": "cve@mitre.org", "url": "https://security.openstack.org/ossa/OSSA-2026-020.html"}, {"source": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2026/06/03/14"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/06/03/14"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "openstack-mistral: OpenStack Mistral: Arbitrary Remote Code Execution via exposed API endpoints", "id": "2484607", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484607"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-749", "details": ["OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.", "A flaw was found in OpenStack Mistral. When the API is exposed, a remote attacker can exploit certain endpoints to achieve arbitrary code execution. This allows the attacker to run malicious code on the system and potentially exfiltrate sensitive service credentials."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the OpenStack Mistral API to trusted internal networks or hosts. Configure firewall rules to limit inbound connections to the Mistral API port (typically 8989) from untrusted sources, ensuring the API is not exposed to the public internet.\nExample using `firewall-cmd` (adjust zones and ports as needed):\n`firewall-cmd --zone=public --remove-port=8989/tcp --permanent`\n`firewall-cmd --zone=internal --add-port=8989/tcp --permanent`\n`firewall-cmd --reload`\nThis action may impact legitimate clients requiring external access to the Mistral API. A service reload or restart may be required for firewall changes to take full effect."}, "name": "CVE-2026-41283", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "openstack-mistral", "product_name": "Red Hat OpenStack Platform 16.2"}], "public_date": "2026-06-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-41283\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41283\nhttps://github.com/openstack/mistral/tags\nhttps://www.openwall.com/lists/oss-security/2026/06/03/14"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[20.0.0,20.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "21.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "22.0.0"}}], "original": {"product": "Mistral", "source": "cna", "vendor": "OpenStack"}, "product": "mistral", "vendor": "openstack"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[20.0.0,20.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "21.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "22.0.0"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "Mistral", "source": "cna", "vendor": "OpenStack"}, "product": "openstack-mistral", "vendor": "redhat"}], "created": "2026-06-04T06:00:08.584317+00:00", "updated": "2026-06-11T02:30:02.695312+00:00", "vendors": ["openstack", "openstack$PRODUCT$mistral", "redhat", "redhat$PRODUCT$openstack-mistral"]}