p PatchFirst

CVE-2026-41283

CVE-2026-41283

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

CVSS 9.9 · Critical · EPSS 0.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • mistral

    Versions
    • ≥ 20.0.0, < 20.1.1: Affected (semver)
    • 21.0.0: Affected (semver)
    • 22.0.0: Affected (semver)

    Update to 20.1.1

  • mistral Debian:12

    Versions
    • 15.0.0-1
    Affected ranges
    • ECOSYSTEM: < 15.0.0-1+deb12u1

    Update to 15.0.0-1+deb12u1

  • mistral Debian:13

    Versions
    • 20.0.0-2
    Affected ranges
    • ECOSYSTEM: < 20.0.0-2+deb13u1

    Update to 20.0.0-2+deb13u1

  • mistral Debian:14

    Versions
    • 20.0.0-2
    • 21.0.0-1
    • 21.0.0-2
    • 21.0.0-4
    • 21.0.0-5
    • 21.0.0-6
    • 21.0.0~rc1-1
    • 21.0.0~rc1-2
    • 22.0.0-1
    • 22.0.0~rc1-1
    • 22.0.0~rc1-2
    • 22.0.0~rc1-3
    Affected ranges
    • ECOSYSTEM: < 22.0.0-3

    Update to 22.0.0-3

  • mistral PyPI

    Versions
    • 20.0.0
    • 20.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 20.0.0, < 20.1.1

    Update to 20.1.1

  • mistral PyPI

    Versions
    • 21.0.0

    No fix published

  • mistral PyPI

    Versions
    • 22.0.0

    No fix published

  • mistral PyPI

    Versions
    • 21.0.0
    • 22.0.0

    No fix published

  • mistral Ubuntu:Pro:16.04:LTS

    Versions
    • 1.0.0-1
    • 1.0.0-4
    • 2.0.0~b3-3
    • 2.0.0~rc1-1
    • 2.0.0~rc2-1
    • 2.0.0-1
    • 2.0.0-1ubuntu2
    • 2.0.0-1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistral Ubuntu:Pro:18.04:LTS

    Versions
    • 5.0.0-0ubuntu1
    • 6.0.0~b1-0ubuntu1
    • 6.0.0~b1-0ubuntu2
    • 6.0.0~b2-0ubuntu1
    • 6.0.0~rc1-0ubuntu1
    • 6.0.0-0ubuntu1
    • 6.0.0-0ubuntu1.1
    • 6.0.0-0ubuntu1.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistral Ubuntu:20.04:LTS

    Versions
    • 9.0.0-0ubuntu1
    • 10.0.0~b1~git2019121815.bc46b29f-0ubuntu1
    • 10.0.0~b2~git2020020609.5b5576dd-0ubuntu1
    • 10.0.0~b3~git2020032611.8a5d35ac-0ubuntu1
    • 10.0.0~b3~git2020041013.a7da00d7-0ubuntu1
    • 10.0.0-0ubuntu0.20.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistral Ubuntu:22.04:LTS

    Versions
    • 13.0.0-0ubuntu1
    • 13.0.0+git2021120910.b2d6de56-0ubuntu1
    • 13.0.0+git2022030313.55bb2564-0ubuntu1
    • 14.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 14.0.0-0ubuntu1.1

    Update to 14.0.0-0ubuntu1.1

  • mistral Ubuntu:24.04:LTS

    Versions
    • 17.0.0-0ubuntu1
    • 18.0.0~rc1-0ubuntu1
    • 18.0.1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 18.0.1-0ubuntu1.1

    Update to 18.0.1-0ubuntu1.1

  • mistral Ubuntu:25.10

    Versions
    • 20.0.0-0ubuntu1
    • 21.0.0~rc1-0ubuntu1
    • 21.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 21.0.0-0ubuntu1.1

    Update to 21.0.0-0ubuntu1.1

  • mistral Ubuntu:26.10

    Versions
    • 22.0.0-0ubuntu1
    • 22.0.0-0ubuntu2
    • 22.0.0+git20260814.61.b4aeb55-0ubuntu1
    • 23.0.0~rc1-0ubuntu1
    • 23.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistral Ubuntu:26.04:LTS

    Versions
    • 21.0.0-0ubuntu1
    • 21.0.0+git20260106.10.420677c8-0ubuntu1
    • 22.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 22.0.0-0ubuntu1.1

    Update to 22.0.0-0ubuntu1.1

Original sources

Check your server →