Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-04T00:00:00 openstack-mistral: OpenStack Mistral: Arbitrary Remote Code Execution via exposed API endpoints 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE-749

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

A flaw was found in OpenStack Mistral. When the API is exposed, a remote attacker can exploit certain endpoints to achieve arbitrary code execution. This allows the attacker to run malicious code on the system and potentially exfiltrate sensitive service credentials.

Restrict network access to the OpenStack Mistral API to trusted internal networks or hosts. Configure firewall rules to limit inbound connections to the Mistral API port (typically 8989) from untrusted sources, ensuring the API is not exposed to the public internet. Example using `firewall-cmd` (adjust zones and ports as needed): `firewall-cmd --zone=public --remove-port=8989/tcp --permanent` `firewall-cmd --zone=internal --add-port=8989/tcp --permanent` `firewall-cmd --reload` This action may impact legitimate clients requiring external access to the Mistral API. A service reload or restart may be required for firewall changes to take full effect. Red Hat OpenStack Platform 16.2 Not affected openstack-mistral https://www.cve.org/CVERecord?id=CVE-2026-41283 https://nvd.nist.gov/vuln/detail/CVE-2026-41283 https://github.com/openstack/mistral/tags https://www.openwall.com/lists/oss-security/2026/06/03/14