CVE-2026-28370 OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection
An authenticated user can trigger code execution on the Vitrage service host via the query parser, leading to potential host compromise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28370?
CVE-2026-28370 is a critical code injection vulnerability in OpenStack Vitrage, published on 27 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.
Weakness: CWE-95
Which versions are affected by CVE-2026-28370?
9 open source packages ship an affected version, including vitrage. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vitrage PyPI | All versions | 12.0.1, 13.0.1, 14.0.1, 15.0.1 |
vitrage PyPI | All versions | 12.0.1 |
vitrage PyPI | All versions | 12.0.1 |
vitrage PyPI | From 13.0.0.0rc1 | 13.0.1 |
vitrage PyPI | From 13.0.0.0rc1 | 13.0.1 |
vitrage PyPI | From 14.0.0.0rc1 | 14.0.1 |
3 more packages
vitrage PyPI | From 14.0.0.0rc1 | 14.0.1 |
vitrage PyPI | From 15.0.0.0rc1 | 15.0.1 |
vitrage PyPI | From 15.0.0.0rc1 | 15.0.1 |
Products include Openstack Vitrage.
How do I fix CVE-2026-28370?
Upgrade vitrage to a fixed version for your release line: 12.0.1, 13.0.1, 14.0.1 or 15.0.1.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-28370 being exploited?
There is no known exploitation of CVE-2026-28370 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-28370, GHSA-8xwf-cr4r-856r, PYSEC-2026-564, UBUNTU-CVE-2026-28370.