Description
In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an arbitrary local command as proxy_command; paramiko starts that command as a subprocess on the executor host under the executor's own service account, independent of whether the SSH connection itself ever succeeds. Only Mistral deployments that permit the std.ssh_proxied action, the default configuration, are affected.
Published: 2026-10-08
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch
AI Analysis

Impact

In OpenStack Mistral versions up to 23.0.0, the std.ssh_proxied action accepts a caller‑supplied proxy_command and passes it straight to paramiko.ProxyCommand() before establishing any SSH connection. The command is executed as a subprocess on the executor host under the service account, so an authenticated project member can run arbitrary local commands with the executor’s privileges, effectively gaining full control of that host and its data.

Affected Systems

OpenStack Mistral is affected, specifically all releases through 23.0.0. The issue applies only to deployments that enable the std.ssh_proxied action, which is the default configuration in most installations.

Risk and Exploitability

The CVSS score is 8.7, indicating high severity. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog. Attackers need authenticated access to the OpenStack REST API, but once they have it they can execute commands on the executor machine. The likely attack vector is network‑facing API access, so the risk remains high for deployments that expose the API and have the default configuration.

Generated by OpenCVE AI on October 8, 2026 at 18:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade OpenStack Mistral to the latest release that addresses the proxy_command validation issue.
  • Disable the std.ssh_proxied action or restrict it to authorized users only by adjusting the Mistral configuration or applying an action‑blocking policy.
  • Restrict API credentials to users who must use the std.ssh_proxied action and monitor usage logs for anomalous activity.

Generated by OpenCVE AI on October 8, 2026 at 18:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title Unvalidated SSH ProxyCommand Allows Arbitrary Command Execution in OpenStack Mistral openstack-mistral: mistral: OS command injection via unvalidated proxy_command in std.ssh_proxied action
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Thu, 08 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Openstack
Openstack mistral
Vendors & Products Openstack
Openstack mistral

Thu, 08 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Title Unvalidated SSH ProxyCommand Allows Arbitrary Command Execution in OpenStack Mistral

Thu, 08 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an arbitrary local command as proxy_command; paramiko starts that command as a subprocess on the executor host under the executor's own service account, independent of whether the SSH connection itself ever succeeds. Only Mistral deployments that permit the std.ssh_proxied action, the default configuration, are affected.
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N'}

Subscriptions

Openstack Mistral
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-08T17:56:35.058Z

Reserved: 2026-09-18T19:09:49.629Z

Link: CVE-2026-93858

cve-icon Vulnrichment

Updated: 2026-10-08T17:55:58.109Z

cve-icon NVD

Status : Deferred

Published: 2026-10-08T18:18:30.817

Modified: 2026-10-08T21:10:41.427

Link: CVE-2026-93858

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-08T19:16:20Z

Links: CVE-2026-93858 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T19:15:20Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')