CVE-2026-41283
OpenStack Mistral versions up to 22.0.0 contain a critical flaw that lets attackers run arbitrary code on the server when the API is exposed. This can lead to theft of credentials and full system compromise. The vulnerability is rated CVSS 9.9.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
OpenStack Mistral versions 22.0.0 and earlier. Users running Mistral with the API exposed to the network are at risk.
Real-world impact
An attacker who can reach the Mistral API can execute any code on the host, exfiltrate credentials, and take full control of the system.
Why this severity
The CVSS score is high because the attack can be performed over the network with low effort, requires only low privileges, and the impact is complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade OpenStack Mistral to a version newer than 22.0.0.
- 02Restart the Mistral service.
NVD description
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.