p PatchFirst

CVE-2026-28370

CVE-2026-28370

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

CVSS 9.1 · Critical · EPSS 0.8% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • vitrage

    Versions
    • ≥ 0, < 12.0.1: Affected (semver)
    • 13.0.0: Affected (semver)
    • 14.0.0: Affected (semver)
    • 15.0.0: Affected (semver)

    Update to 12.0.1

  • vitrage Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.0.0-3+deb12u1

    Update to 9.0.0-3+deb12u1

  • vitrage Debian:13

    Versions
    • 14.0.0-4
    Affected ranges
    • ECOSYSTEM: < 14.0.0-4+deb13u1

    Update to 14.0.0-4+deb13u1

  • vitrage PyPI

    Versions
    • 15.0.0
    • 15.0.0.0rc1
    Affected ranges
    • ECOSYSTEM: ≥ 15.0.0.0rc1, < 15.0.1

    Update to 15.0.1

  • vitrage PyPI

    Versions
    • 14.0.0
    • 14.0.0.0rc1
    Affected ranges
    • ECOSYSTEM: ≥ 14.0.0.0rc1, < 14.0.1

    Update to 14.0.1

  • vitrage PyPI

    Versions
    • 13.0.0
    • 13.0.0.0rc1
    Affected ranges
    • ECOSYSTEM: ≥ 13.0.0.0rc1, < 13.0.1

    Update to 13.0.1

  • vitrage PyPI

    Versions
    • 0.0.1.dev451
    • 0.2.0
    • 0.7.0
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.6.0
    • 1.7.0
    • 1.8.0
    • 1.8.1
    • 1.8.2
    • 1.8.3
    • 10.0.0
    • 10.0.0.0rc1
    • 11.0.0
    • 11.0.0.0rc1
    • 12.0.0
    • 12.0.0.0rc1
    • 12.0.0.0rc2
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 3.0.0
    • 3.1.0
    • 3.2.0
    • 3.3.0
    • 4.0.0
    • 4.1.0
    • 4.2.0
    • 4.3.0
    • 4.3.1
    • 4.3.2
    • 5.0.0
    • 5.0.1
    • 5.0.2
    • 6.0.0
    • 6.0.1
    • 7.0.0
    • 7.1.0
    • 7.2.0
    • 7.3.0
    • 7.4.0
    • 7.5.0
    • 8.0.0
    • 8.0.1
    • 9.0.0
    Affected ranges
    • ECOSYSTEM: < 12.0.1

    Update to 12.0.1

  • vitrage PyPI

    Versions
    • 0.0.1.dev451
    • 0.2.0
    • 0.7.0
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.6.0
    • 1.7.0
    • 1.8.0
    • 1.8.1
    • 1.8.2
    • 1.8.3
    • 10.0.0
    • 10.0.0.0rc1
    • 11.0.0
    • 11.0.0.0rc1
    • 12.0.0
    • 12.0.0.0rc1
    • 12.0.0.0rc2
    • 13.0.0
    • 13.0.0.0rc1
    • 14.0.0
    • 14.0.0.0rc1
    • 15.0.0
    • 15.0.0.0rc1
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 3.0.0
    • 3.1.0
    • 3.2.0
    • 3.3.0
    • 4.0.0
    • 4.1.0
    • 4.2.0
    • 4.3.0
    • 4.3.1
    • 4.3.2
    • 5.0.0
    • 5.0.1
    • 5.0.2
    • 6.0.0
    • 6.0.1
    • 7.0.0
    • 7.1.0
    • 7.2.0
    • 7.3.0
    • 7.4.0
    • 7.5.0
    • 8.0.0
    • 8.0.1
    • 9.0.0
    Affected ranges
    • ECOSYSTEM: < 12.0.1 ∪ ≥ 13.0.0.0rc1, < 13.0.1 ∪ ≥ 14.0.0.0rc1, < 14.0.1 ∪ ≥ 15.0.0.0rc1, < 15.0.1

    Update to 12.0.1; Update to 13.0.1; Update to 14.0.1; Update to 15.0.1

  • vitrage Ubuntu:20.04:LTS

    Versions
    • 4.3.1-3
    • 6.0.0-0ubuntu1
    • 6.0.1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vitrage Ubuntu:22.04:LTS

    Versions
    • 7.5.0-0ubuntu1
    • 7.5.0+git2021120910.95b33dbf-0ubuntu1
    • 7.5.0+git2022011309.43091cd4-0ubuntu1
    • 7.5.0+git2022011309.43091cd4-0ubuntu2
    • 8.0.1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vitrage Ubuntu:24.04:LTS

    Versions
    • 11.0.0-0ubuntu1
    • 12.0.0~rc2-0ubuntu1
    • 12.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vitrage Ubuntu:25.10

    Versions
    • 14.0.0-0ubuntu1
    • 14.0.0+git2025070714.aafc997e-0ubuntu1
    • 15.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vitrage Ubuntu:26.10

    Versions
    • 15.0.0+git20250930.3.5b57e2b3-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vitrage Ubuntu:26.04:LTS

    Versions
    • 15.0.0-0ubuntu1
    • 15.0.0+git20250930.3.5b57e2b3-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →