UNKNOWN OpenStack
CVE-2026-41283
OSSA-2026-020: Mistral policy enforcement bypass allows unauthorized public resource creation and arbitrary code execution
Eduardo Gonzalez Gutierrez and Arnaud Morin (OVHcloud) reported that several Mistral API endpoints do not enforce access policies, allowing any authenticated user to create public resources and upload arbitrary code that executes on Mistral executor workers. An attacker could extract sensitive data including service credentials from the worker. Deployments exposing the Mistral API are affected. Patches ¶ https://review.opendev.org/991416 (2025.1/epoxy) https://review.opendev.org/991417 (2025.1/e
Affected Products
- Mistral: >=20.0.0 <20.1.1, ==21.0.0, ==22.0.0
- CVE-2026-41283
References
- https://security.openstack.org/ossa/OSSA-2026-020.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-41283
This unknown severity vulnerability was published on 2026-06-03 via OpenStack. Affected: Mistral: >=20.0.0 <20.1.1, ==21.0.0, ==22.0.0, CVE-2026-41283.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.