Bug 2544711 (CVE-2026-93858)

Summary: CVE-2026-93858 openstack-mistral: mistral: OS command injection via unvalidated proxy_command in std.ssh_proxied action
Product: [Other] Security Response Reporter: Robb Gatica <rgatica>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: eglynn, jjoyce, jpretori, jschluet, jslagle, lhh, mburns, mgarciac, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in OpenStack Mistral. The std.ssh_proxied built-in action accepts a user-supplied proxy_command parameter that is passed without validation to a system subprocess call on the Mistral executor host. An authenticated attacker can craft a malicious workflow that supplies an arbitrary command string as the proxy_command parameter, causing the Mistral executor to run that command as its operating system process user. Successful exploitation allows full remote code execution on the executor host with the privileges of the Mistral executor service account.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-10-08   

Description Robb Gatica 2026-10-01 18:56:36 UTC 
A flaw was found in OpenStack Mistral. By supplying a specially crafted action payload to Mistral's ssh_proxied action provider, an unprivileged authenticated user can override paramiko's proxy_command, resulting in execution of arbitrary code on the executor host operating system.

Only Mistral deployments allowing the std.ssh_proxied action provider are affected. This action provider is enabled by default.

Affected versions: <20.1.1, ==21.0.0, ==22.0.0, ==23.0.0

Reference: https://launchpad.net/bugs/2162100