CVE Intelligence
Analysis AI-assisted

CVE-2026-41283: OpenStack Mistral Incorrect Authorization Leading to Remote Code Execution

CVE-2026-41283 affects OpenStack Mistral through 22.0.0 and is described as allowing arbitrary remote code execution when the API is exposed. The record classifies the weakness as Incorrect Authorization (CWE-863) and rates it critical with a CVSS base score of 9.9. No KEV listing or confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes a flaw in OpenStack Mistral through 22.0.0 in which certain endpoints allow code execution, and the API can be reached remotely when it is exposed. The weakness is categorized as Incorrect Authorization (CWE-863). Details are taken from the CVE record and the references listed below.

Impact

  • Arbitrary remote code execution is stated as the primary consequence.
  • The description notes that this can lead to exfiltration of service credentials.
  • The record rates the issue critical with a CVSS base score of 9.9 and a vector indicating high confidentiality, integrity and availability impact.
  • SSVC data in the record lists exploitation as none, automatable as no and technical impact as total.

Affected products and versions

  • The record lists OpenStack Mistral with ranges from 20.0.0 up to but not including 20.1.1, version 21.0.0 and version 22.0.0.
  • The description refers to versions through 22.0.0.
  • The record contains no fixed version. This does not mean that no fix exists; consult the vendor advisory and the Red Hat tracking entries for current guidance.

Exploitation status

  • CISA KEV does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.
  • EPSS in the record gives a probability of 0.00915 and a percentile of 0.59781.

Remediation and mitigation

  • Limit network exposure of the Mistral API to trusted management networks until a fixed release is confirmed for your deployment.
  • Review the vendor advisory OSSA-2026-020 and the Red Hat CVE page for affected builds and fixed releases.
  • Apply the vendor-provided update once it is confirmed for your version line.
  • If exposure is suspected, review and rotate service credentials that the Mistral service can access.

Detection guidance

  • Review API access logs for requests to Mistral endpoints from unexpected or untrusted sources.
  • Monitor for unexpected execution activity and for unusual use of service accounts associated with the Mistral service.
  • Correlate authentication events with changes in service configuration to identify possible misuse.

Limitations of the available information

  • The record has no fixed version and no KEV details, and its title field is empty, so the title here was written from the product and weakness class.
  • It is unknown whether default deployments expose the API.
  • The exact endpoints, preconditions and scope of the flaw are not described in the record.
  • The advisory and Red Hat pages are referenced, but their content was not reviewed here.

Frequently asked questions

Is this CVE confirmed as exploited in the wild?

No. The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which OpenStack Mistral versions are listed as affected?

The record lists from 20.0.0 up to but not including 20.1.1, version 21.0.0 and version 22.0.0. It does not list a fixed version, so check the vendor advisory for current guidance.

What should administrators do now?

Limit exposure of the Mistral API to trusted networks, follow the vendor advisory for fixed releases, and review service credentials if exposure is suspected.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.