Bug 2544711 (CVE-2026-93858) - CVE-2026-93858 openstack-mistral: mistral: OS command injection via unvalidated proxy_command in std.ssh_proxied action
Summary: CVE-2026-93858 openstack-mistral: mistral: OS command injection via unvalidat...
Keywords:
Status: NEW
Alias: CVE-2026-93858
Deadline: 2026-10-08
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-01 18:56 UTC by Robb Gatica
Modified: 2026-10-08 19:17 UTC (History)
9 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Robb Gatica 2026-10-01 18:56:36 UTC 
A flaw was found in OpenStack Mistral. By supplying a specially crafted action payload to Mistral's ssh_proxied action provider, an unprivileged authenticated user can override paramiko's proxy_command, resulting in execution of arbitrary code on the executor host operating system.

Only Mistral deployments allowing the std.ssh_proxied action provider are affected. This action provider is enabled by default.

Affected versions: <20.1.1, ==21.0.0, ==22.0.0, ==23.0.0

Reference: https://launchpad.net/bugs/2162100
Note You need to log in before you can comment on or make changes to this bug.