CVE-2026-41283Disclosure

MEDIUMCVSS 9.9 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

Back to dashboard

5.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-863CWE-749

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
7 mentions across 6 observed days

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 6 signals
Disclosure: 4 classified signals
General: 2 classified signals
Peaked 4d ago at 2 mentions (2026-06-04); latest day: 1
7 total mentions across 6 days

Deep dive

Activity timeline7 mentions / 6d

Signal classification3 categories

Disclosure

457.1%

General

228.6%

Active Exploitation

114.3%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-03	1	General1
2026-06-04	2	Disclosure2
2026-06-07	1	General1
2026-06-08	1	Disclosure1
2026-06-12	1	Active Exploitation1
2026-06-25	1	Disclosure1

Full discourse7 posts

Open Source Security mailing list@oss_security133d
General
OpenStack OSSA-2026-019: Ironic: File Extraction from conductor via pxe_template (CVE-2026-44917) https://www.openwall.com/lists/oss-security/2026/06/03/13 OSSA-2026-020: Mistral: Policy bypass allows unauthorized public resource creation and arbitrary code execution (CVE-2026-41283) https://www.openwall.com/lists/oss-security/2026/06/03/14
Post summary
The text lists two OpenStack advisories with their CVEs and brief vulnerability descriptions, but offers no PoC, exploit code, patch, or active exploitation information.
10020675
4.6K followersView on X
Kaitan ID Security@KaitanSecurity128d
Active Exploitation
⚡ OpenStack Mistral Remote Code Execution CVE-2026-41283 (CVSS 9.9) in OpenStack Mistral allows arbitrary remote code execution when the API is publicly exposed — and an exploit is already in circulation. Mistral's…
Post summary
CVE-2026-41283 is a critical remote code execution flaw in OpenStack Mistral with high CVSS 9.9; an exploit is already circulating and likely being used in the wild, while no patch or mitigation has been mentioned.
1000032
81 followersView on X
SecAlerts@SecAlertsCo136d
Disclosure
CVE-2026-41283: Critical 9.9 in OpenStack Mistral through 22.0.0. Policy enforcement bypass enables RCE via exposed API endpoints, leading to service credential exfiltration. If Mistral is in your stack, treat this as urgent. https://secalerts.co/vulnerability/CVE-2026-41283 https://t.co/M3GjArHlb2
Post summary
The advisory announces a critical CVE‑2026‑41283 in OpenStack Mistral that permits remote code execution via a policy bypass, but it does not provide a PoC, exploit code, or patch information.
0100080
826 followersView on X
IntegSec@integ_sec115d
Disclosure
CVE-2026-41283: OpenStack Mistral Arbitrary Code Execution Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q04mF7m-0
Post summary
The text announces the discovery of a new Arbitrary Code Execution vulnerability in OpenStack Mistral (CVE‑2026‑41283) but does not provide evidence of active exploitation, a PoC, or a patch.
0000043
31 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters133d
Disclosure
CVE-2026-41283 - Critical RCE in OpenStack Mistral. API exposure allows code exec & credential exfiltration. CVSS 9.9. No patch yet - restrict API access immediately. #CVE #OpenStack #infosec #CVEAlert More Free CVES and FIXES: https://www.valtersit.com/cve/CVE-2026-41283
Post summary
A newly disclosed critical remote code execution flaw in OpenStack Mistral (CVE‑2026‑41283) is highlighted, with a CVSS of 9.9 and no patch available, prompting immediate API access restriction.
0000062
921 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-41283 OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfi… https://www.cve.org/CVERecord?id=CVE-2026-41283
Post summary
A newly disclosed CVE (2026-41283) affects OpenStack Mistral versions up to 22.0.0, enabling arbitrary remote code execution when the API is exposed; the tweet lists the vulnerability but omits PoC, patch, or exploitation details.
00000164
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
General
CVE-2026-41283 [OSSA-2026-020] OpenStack Mistral https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41283
Post summary
The text merely lists a CVE identifier for OpenStack Mistral and provides a link to a vulnerability database. No further exploitation, patch, or technical details are included.
0000039
4.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-41283

Kaitan ID Security[verified]@KaitanSecurityActive Exploitation

CVE-2026-41283 is a critical remote code execution flaw in OpenStack Mistral with high CVSS 9.9; an exploit is already circulating and likely being used in the wild, while no patch or mitigation has been mentioned.

IntegSec[verified]@integ_secDisclosure

The text announces the discovery of a new Arbitrary Code Execution vulnerability in OpenStack Mistral (CVE‑2026‑41283) but does not provide evidence of active exploitation, a PoC, or a patch.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersDisclosure

A newly disclosed critical remote code execution flaw in OpenStack Mistral (CVE‑2026‑41283) is highlighted, with a CVSS of 9.9 and no patch available, prompting immediate API access restriction.

Open Source Security mailing list@oss_securityGeneral

The text lists two OpenStack advisories with their CVEs and brief vulnerability descriptions, but offers no PoC, exploit code, patch, or active exploitation information.

SecAlerts@SecAlertsCoDisclosure

The advisory announces a critical CVE‑2026‑41283 in OpenStack Mistral that permits remote code execution via a policy bypass, but it does not provide a PoC, exploit code, or patch information.

CVE@CVEnewDisclosure

A newly disclosed CVE (2026-41283) affects OpenStack Mistral versions up to 22.0.0, enabling arbitrary remote code execution when the API is exposed; the tweet lists the vulnerability but omits PoC, patch, or exploitation details.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The text merely lists a CVE identifier for OpenStack Mistral and provides a link to a vulnerability database. No further exploitation, patch, or technical details are included.