CVE-2026-41283

CriticalCVSS 9.9/10Last modified Jul 22, 2026

Description

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-863CWE-749

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 4, 2026
Last modified
Jul 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-412847.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 throuCVE-2026-412854.3In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (CVE-2026-412866.5Stack-based Buffer Overflow vulnerability in the WatchGuard Agent discovery service on Windows allows Overflow Buffers. An unauthenticated aCVE-2026-412876.5Stack-based Buffer Overflow vulnerability in the WatchGuard Agent discovery service on Windows allows Overflow Buffers. An unauthenticated aCVE-2026-412887.8Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated CVE-2026-41298.1There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access hoCVE-2026-412927.5NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoCVE-2026-412939.8Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 CVE-2026-412948.6OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variablCVE-2026-412957.8OpenClaw before 2026.4.2 contains an improper trust boundary vulnerability allowing untrusted workspace channel shadows to execute during buCVE-2026-412968.2OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows CVE-2026-412977.6OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows
CVE-2026-41283: Critical severity, CVSS 9.9 | Vulnix