[OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147))
OpenStack Mistral has four authorization and privilege flaws in OSSA-2026-044.
OpenStack advisory OSSA-2026-044, dated 8 October 2026, covers four authorization and privilege vulnerabilities in the Mistral workflow service. The flaws are CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, and CVE-2026-97147. Affected releases are Mistral before 20.1.1 and the exact versions 21.0.0, 22.0.0, and 23.0.0. The posting credits Arnaud Morin and does not report active exploitation.
- Four CVEs affect OpenStack Mistral authorization and privileges.
- Affected builds are before 20.1.1 and versions 21.0.0, 22.0.0, and 23.0.0.
- Published as OSSA-2026-044 on 8 October 2026.
- No in-the-wild exploitation is described.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-93858+3 related CVEs | Command injection in OpenStack Mistral std.ssh_proxied | 8.7 group max | — |
From the original article
Posted by Jeremy Stanley on Oct 08 ========================================================================== OSSA-2026-044: Four authorization and privilege vulnerabilities in Mistral ========================================================================== :Date: October 08, 2026 :CVE: CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147 Affects ~~~~~~~ - Mistral: <20. 1. 1, ==21.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.