CVE-2026-41283 OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed
Attackers can execute arbitrary code via exposed API endpoints in OpenStack Mistral, leading to credential exfiltration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41283?
CVE-2026-41283 is a critical code injection vulnerability in OpenStack Mistral, published on 4 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
Which versions are affected by CVE-2026-41283?
6 open source packages ship an affected version, including mistral.
| Package | Affected | Fixed in |
|---|---|---|
mistral PyPI | All versions | None |
mistral PyPI | All versions | None |
mistral PyPI | All versions | None |
mistral PyPI | From 20.0.0 | 20.1.1 |
mistral PyPI | From 20.0.0 | 20.1.1 |
mistral PyPI | From 20.0.0 | 20.1.1 |
How do I fix CVE-2026-41283?
Upgrade mistral to 20.1.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-41283 being exploited?
There is no known exploitation of CVE-2026-41283 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-41283, GHSA-9hfw-w3f4-c4p8, PYSEC-2026-3486, UBUNTU-CVE-2026-41283.