CVE-2026-28370

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-95

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-283727.8telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added CVE-2026-283739.6The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality w CVE-2026-283744.3Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.CVE-2026-283756.5A testdata data-source can be used to trigger out-of-memory crashes in Grafana.CVE-2026-283766.5The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potential CVE-2026-283777.5A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing CVE-2026-283782.7The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public d CVE-2026-283796.5A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that c CVE-2026-28384.4The Whole Enquiry Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘woowhole_success_msg’ para CVE-2026-283806.5Any Editor could delete any snapshot, even if they have no access to read or write them.CVE-2026-283818.1The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/wr CVE-2026-283836.5A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An