CVE-2026-93858

OpenStack Mistral through 23.0.0 passes a caller-supplied proxy_command string straight into paramiko.ProxyCommand() inside the std.ssh_proxied action, before any SSH connection to a gateway or target is attempted. An authenticated project member can submit an arbitrary local command through the standard action-execution API; paramiko then starts that command as a subprocess on the executor host under the executor service account, whether or not the SSH session succeeds. Successful abuse yields command execution with the service account’s privileges on the executor (high confidentiality, integrity, and availability impact on that host). Only deployments that leave std.ssh_proxied permitted, which is the default, are affected. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: On every Mistral executor, disable or deny the std.ssh_proxied action unless it is strictly required, and limit which project members can call the action-execution API. Treat executor hosts as compromised until reviewed for unexpected subprocesses run as the Mistral service account, and apply the vendor fix as soon as a release after 23.0.0 is available.