CVE-2026-97147
Description
A flaw was found in OpenStack Mistral. Due to a missing authorization check in the action definition and environment update paths, an authenticated user can modify or overwrite another project's publicly-scoped action definitions and environments. An attacker with a valid account in any project can craft an API request targeting a public resource by name and overwrite its content or change its scope. A project member can also create a workbook whose embedded action names collide with another project's public actions, transferring ownership of those resources to the attacker's project and causing the original owner's subsequent updates to fail. This vulnerability affects all deployments that expose the Mistral v2 API.
Statement
Red Hat product impact analysis pending. Component mapping required to determine which Red Hat products ship openstack-mistral at the affected version range (<20.1.1, ==21.0.0, ==22.0.0, ==23.0.0). Products shipping Mistral through Red Hat OpenStack Platform should be evaluated for the affected version. No compensating controls in the Mistral codebase itself limit the exploitability of this issue for the action definition and environment update paths.
Mitigation
No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Red Hat CVSS v3 Score Explanation
Network API, low complexity (public names are enumerable), authenticated user only, no interaction; integrity fully lost for targeted resource, availability low (owner's operations disrupted)
Acknowledgements
Upstream acknowledges Arnaud Morin (OVHcloud) as the original reporter.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
