CVE-2026-41283 | CVE Tracker

Description

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

Scores

CVSS scores of CVE-2026-41283, by who scored it
Scored by	CVSS	Score	Vector
mitreCNA (assigner)	3.1	Critical9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
redhat-SADPADP (enrichment)	3.1	Critical9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVDNVD · Awaiting Analysis	3.1	Critical9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.73% · top 45% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.9.

Weakness

CWE-863 Incorrect Authorization (opens in a new tab)All about CWE-863 and its CVEs
CWE-749: Exposed Dangerous Method or Function (opens in a new tab)All about CWE-749 and its CVEs

Affected products

OpenStack · Mistral
- affected 20.0.0 – < 20.1.1
- affected 21.0.0
- affected 22.0.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

PyPImistralGHSA-9hfw-w3f4-c4p8 (opens in a new tab)

References (7)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-41283](https://trackcve.app/badge/CVE-2026-41283.svg)](https://trackcve.app/cve/CVE-2026-41283)

Record last updated 15 Jul 2026, 00:59 UTC.

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code…