CVE-2026-41283: OpenStack Mistral through 22

Synopsis

An arbitrary remote code execution vulnerability affects OpenStack Mistral through version 22.0.0. The affected API endpoints can be reached over the network by any authenticated user with a low-privilege account, requiring no victim interaction. Successful exploitation gives an attacker full code execution on the server, with access to service credentials and the ability to read, modify, or destroy data. A patched-image rebuild at version 20.1.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Mistral API over the network; any internet- or intranet-exposed deployment is in scope.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative rights are needed to reach the vulnerable endpoints.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker interacts directly with the API.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special memory layout are required.

Blast Radius

• Attacker executes arbitrary code in the Mistral service process, gaining full control of the workflow engine.
• Service credentials (API keys, database passwords, inter-service tokens) stored or accessible by Mistral are exposed and can be exfiltrated.
• All data readable by the Mistral service, including workflow definitions and execution history, can be read or modified.
• The Mistral service and any dependent workflow jobs can be crashed or permanently disrupted.