Executive brief
OpenStack Mistral, a workflow service used to manage and automate tasks in cloud environments, contains a vulnerability that allows users to bypass security policies. An attacker with basic access can upload and run malicious code on the system's background workers. This could lead to the theft of sensitive service credentials and full control over the workflow automation environment.
Technical details
A vulnerability in OpenStack Mistral (CVE-2026-41283) stems from a failure to enforce access policies across several API endpoints (CWE-863, CWE-749). This allows an authenticated user with network access to the Mistral API to create public resources and upload arbitrary code. The uploaded code is subsequently executed on Mistral executor workers. Successful exploitation enables remote code execution (RCE) and the potential exfiltration of sensitive service credentials from the worker environment. The issue affects versions 20.0.0 through 22.0.0 and is addressed in version 20.1.1 and subsequent patches.
Affected products
- OpenStack Mistral >= 20.0.0, < 20.1.1; 21.0.0; 22.0.0
Timeline
- 2026-06-03: advisory: OpenStack Security Advisory OSSA-2026-020 released
- 2026-06-04: disclosed: CVE-2026-41283 published
- 2026-07-14: patched: GitHub advisory updated with reviewed status and patch information