OpenStack Mistral CVE-2026-41283: Brief Summary of a Critical Policy Bypass Leading to Remote Code Execution

Introduction

A policy enforcement bypass in OpenStack Mistral's REST API V2 lets any authenticated user create public workflows containing arbitrary code and run them on Mistral executor workers. From there, an attacker can exfiltrate service credentials that can unlock lateral movement across an entire OpenStack deployment. OSSA-2026-020 disclosed CVE-2026-41283 on June 3, 2026, and the NVD published it the following day. It carries a CVSS score of 9.9 and affects Mistral versions spanning four active OpenStack release series.

Mistral is the workflow service in the OpenStack ecosystem. Users define multi-step processes in YAML-based workflow definitions and run them through a REST API. It is commonly used for administrator tasks such as managing clusters, deploying distributed software at scale, and orchestrating operations that span multiple OpenStack components. OpenStack is the leading open source cloud computing platform, with a market estimated at approximately USD 30.11 billion in 2025, and Mistral deployments are present in a significant number of enterprise and service provider environments.

Technical information

Root cause: Incorrect Authorization (CWE-863)

CVE-2026-41283 is classified under CWE-863: Incorrect Authorization, which MITRE defines as occurring when "the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check." In Mistral's case, several REST API V2 endpoints do not enforce access policies at all, so the authorization checks are bypassed completely. Any authenticated user who can reach the Mistral API can perform actions that should be restricted to administrators or specifically authorized roles.

MITRE assigned the vulnerability (source: [email protected]), and the NVD published it on June 4, 2026. Goutham Pacha Ravi of the OpenStack Vulnerability Management Team posted the official advisory, OSSA-2026-020, to the oss-security mailing list on June 3, 2026.

Two exploitation paths

The advisory identifies two primary exploitation paths that the policy bypass opens:

1. An attacker can create public resources, such as workflows, without proper authorization. In Mistral, "public" resources are visible and accessible to all users in the OpenStack deployment, which makes them an effective vector for distributing malicious payloads across tenants.
2. Several Mistral API endpoints permit code execution. With policy enforcement bypassed, an attacker can upload arbitrary code that runs directly on Mistral executor workers. The advisory states: "An attacker could extract sensitive data including service credentials from the worker."

Full exploitation chain

The attack runs in six steps:

1. An authenticated user (even one with minimal privileges) accesses an exposed Mistral API endpoint.
2. The attacker bypasses the broken policy enforcement on the REST API V2 endpoints.
3. The attacker creates a public workflow containing arbitrary code execution instructions.
4. The workflow is triggered, and the code executes on a Mistral executor worker.
5. The executor worker holds the service credentials Mistral uses to interact with other OpenStack services (compute, storage, networking), so the attacker exfiltrates those credentials.
6. With the stolen credentials, the attacker moves laterally across the OpenStack deployment.

The chain is a particular concern in multi-tenant environments, where a low-privilege user in one tenant could compromise service credentials that span tenant boundaries.

Scope and impact

The CVSS 9.9 score reflects a network-accessible attack vector, low attack complexity, low required privileges, and the ability to affect the confidentiality, integrity, and availability of the target system and potentially other systems in the deployment. The credential exfiltration is what raises this from a standard RCE to a deployment-wide compromise.

Eduardo Gonzalez Gutierrez (Independent) and Arnaud Morin of OVHcloud discovered the vulnerability and reported it responsibly.

Affected systems and versions

The following Mistral versions are affected:

Deployments that do not expose the Mistral API to the network are not directly affected by the remote code execution vector, though authenticated users with internal network access could still exploit the vulnerability. The advisory states: "Deployments exposing the Mistral API are affected."

The OpenStack VMT coordinated 32 patches across four release series (Epoxy, Flamingo, Gazpacho, Hibiscus), with 8 patches per series available through the OpenDev Gerrit review system. Organizations should identify their deployed release series and apply all corresponding patches. As interim measures, restrict network access to Mistral API endpoints and rotate all service credentials that Mistral executor workers can access.

Vendor security history

This is at least the fourth CVE affecting OpenStack Mistral, and the severity has clearly escalated:

The first three were moderate-severity issues. This one is a CVSS 9.9 critical RCE. CVE-2019-3866 also involved improper access controls (world-readable log files exposing credentials), which suggests that authorization enforcement has been a persistent weakness in Mistral's design rather than an isolated incident.

Elsewhere in OpenStack, the VMT has issued multiple advisories in 2026, including policy bypasses in Neutron (OSSA-2026-016), authorization bypasses in Keystone (OSSA-2026-015), and RCE in Ironic when the Anaconda driver is enabled (OSSA-2026-012). The pattern indicates ongoing security problems across the OpenStack ecosystem, though the project's coordinated disclosure and patching process remains structured and responsive.

OpenStack's incident response process is mature, with private patch review, coordinated advisory publication, and Gerrit-based patch distribution. But authorization weaknesses keep recurring in Mistral, and that suggests the component's security architecture would benefit from a fundamental review rather than continued point patching.

References

• NVD: CVE-2026-41283
• OSSA-2026-020: OpenStack Mistral Policy Enforcement Bypass (oss-security)
• OSSA-2026-020 Advisory (SecLists)
• OpenStack Mistral GitHub Tags
• OpenStack Security Advisories
• Mistral REST API V2 Documentation
• Mistral Workflow Service Documentation
• CWE-863: Incorrect Authorization
• OpenStack Mistral CVE History (OpenCVE)
• CVE-2021-4472 Detail (NVD)
• CVE-2019-3866 Detail (NVD)
• CVE-2018-16848 Record
• CISA Known Exploited Vulnerabilities Catalog