Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-41283

43
FAUCET Score

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

First published: Jun 4, 2026Last modified: Jun 4, 2026

Impacted Technologies

VendorProductVersion(s)CPE
OpenStackMistral
>= 20.0.0, < 20.1.1, 21.0.0, 22.0.0CNA affecteddefault unaffected

CVSS Data

CVSS version used by this source: 3.1

9.9CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.1
Impact Score
6.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.73%
Probability of exploitation in next 30 days
EPSS Percentile
50.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0073 is in the 57th percentile among its peer group of 1,128 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 1.0 Bluesky, 0.5 Mastodon, and 1.6 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

pippatch availablevia ghsa
Product: mistralFixed in: 20.1.1
ubuntupatch availablevia ubuntu_usn
Product: mistral (jammy)Fixed in: 14.0.0-0ubuntu1.1
ubuntupatch availablevia ubuntu_usn
Product: mistral (noble)Fixed in: 18.0.1-0ubuntu1.1
ubuntupatch availablevia ubuntu_usn
Product: mistral (questing)Fixed in: 21.0.0-0ubuntu1.1
ubuntupatch availablevia ubuntu_usn
Product: mistral (resolute)Fixed in: 22.0.0-0ubuntu1.1

Vendor Advisories (2)

ubuntuUSN-8422-1

Mistral vulnerability

Jun 11, 2026
pipGHSA-9hfw-w3f4-c4p8critical

OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed

Jun 4, 2026

References

access.redhat.com / security/cve/CVE-2026-41283
bugzilla.redhat.com / show_bug.cgi
security.access.redhat.com / data/csaf/v2/vex/2026/cve-2026-41283.json
openwall.com / lists/oss-security/2026/06/03/14
github.com / openstack/mistral/tags
security.openstack.org / ossa/OSSA-2026-020.html
openwall.com / lists/oss-security/2026/06/03/14