GitHub Advisoryadvisory · PyPI

GHSA-8xwf-cr4r-856r OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection

CRITICAL Published 2026-02-27 Modified 2026-03-05 Official page ↗
Aliases
CVE-2026-28370
Ecosystem
PyPI
Packages
vitrage
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-95
Reviewed
2026-02-28

Affected packages

• PyPI vitrage: >= 15.0.0.0rc1, < 15.0.1 → fixed in 15.0.1 • PyPI vitrage: >= 14.0.0.0rc1, < 14.0.1 → fixed in 14.0.1 • PyPI vitrage: >= 13.0.0.0rc1, < 13.0.1 → fixed in 13.0.1 • PyPI vitrage: < 12.0.1 → fixed in 12.0.1

Description

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Related

Alias · CVE (1)

  • CVE-2026-28370 In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger… vulnerability

Weakness · CWE (1)

  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References