OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed

CRITICAL 9.9CVE-2026-41283 · GHSA-9hfw-w3f4-c4p8 · PYSEC-2026-3486 · Published 04/06/2026 · updated 22/07/2026

Package	Affected versions	Patched versions
mistral PyPI	`= 21.0.0= 22.0.0≥ 20.0.0, < 20.1.1`	`20.1.1`

Description

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

NVD description

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

References

nvd.nist.gov/vuln/detail/CVE-2026-41283 · ADVISORY
access.redhat.com/security/cve/CVE-2026-41283 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
openstack/mistral · PACKAGE
openstack/mistral · WEB
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41283.json · WEB
security.openstack.org/ossa/OSSA-2026-020.html · WEB
openwall.com/lists/oss-security/2026/06/03/14 · WEB
openwall.com/lists/oss-security/2026/06/03/14 · WEB
pypi.org/project/mistral · PACKAGE
GitHub Advisory GHSA-9hfw-w3f4-c4p8 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free