GitHub Advisoryadvisory · PyPI

GHSA-9hfw-w3f4-c4p8 OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed

CRITICAL Published 2026-06-04 Modified 2026-07-14 Official page ↗
Aliases
CVE-2026-41283
Ecosystem
PyPI
Packages
mistral
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-749, CWE-863
Reviewed
2026-07-14

Affected packages

• PyPI mistral: >= 20.0.0, < 20.1.1 → fixed in 20.1.1 • PyPI mistral: 21.0.0 (no fix yet) • PyPI mistral: 22.0.0 (no fix yet)

Description

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

Related

Alias · CVE (1)

  • CVE-2026-41283 OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. vulnerability

Weakness · CWE (2)

  • CWE-749 Exposed Dangerous Method or Function weakness
  • CWE-863 Incorrect Authorization weakness

References