CVE-2026-41283

CriticalCVSS 9.9

Published: 04/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.73%

51th percentile - higher than 51% of all known CVEs

Summary

OpenStack Mistral through version 22.0.0 contains a remote code execution vulnerability when the API is exposed. Endpoints allow code execution, which can lead to exfiltration of service credentials.

Risk Assessment

An attacker can remotely execute arbitrary code on the Mistral server, take control of the service, and steal sensitive credentials.

Recommendation

Upgrade OpenStack Mistral to the latest available version that fixes this vulnerability. Restrict access to the Mistral API to trusted networks only.

Original NVD description (English source)

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.