CVE-2026-41283 — Vulnerability in mistral — CVE Details

CRITICAL

OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed

Published June 4, 2026Updated July 23, 2026Source: osv

Summary

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

Advisory Timeline

First published June 4, 2026 (130 days ago).
Last revised July 23, 2026 — 49 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

pip

Update mistral to 20.1.1 or later

pip install "mistral>=20.1.1"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: pypi (1).

Package	Ecosystem	Affected	Fixed In
mistral	pypi	22.0.0	No fix available
mistral	pypi	20.0.0, 20.1.0	20.1.1
mistral	pypi	21.0.0	No fix available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-749
View on MITRE
CWE-863
Incorrect AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-41283?: OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2026-41283?: CVE-2026-41283 affects mistral. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-41283 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-9hfw-w3f4-c4p8

PYSEC-2026-3486

Related CVEs

CVE-2026-61447
CRITICAL
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
CVE-2026-61445
CRITICAL
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

More PyPI advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies