CVE-2026-93858 in Mistral
Summary
by MITRE • 10/08/2026
In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an arbitrary local command as proxy_command; paramiko starts that command as a subprocess on the executor host under the executor's own service account, independent of whether the SSH connection itself ever succeeds. Only Mistral deployments that permit the std.ssh_proxied action, the default configuration, are affected.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in OpenStack Mistral through version 23.0.0 represents a critical server-side request forgery and command injection flaw within the orchestration engine's standard library actions. Specifically, the std.ssh_proxied action is designed to facilitate SSH connections through an intermediate proxy host by accepting a user-supplied proxy_command parameter. However, the implementation fails to perform adequate input validation or sanitization on this parameter before passing it directly to paramiko.ProxyCommand(). This architectural oversight allows any authenticated project member with access to the standard action-execution API to inject arbitrary operating system commands that are executed locally on the Mistral executor host. The severity of this flaw is compounded by the fact that execution occurs independently of whether the subsequent SSH connection attempt succeeds, meaning an attacker can achieve remote code execution simply by submitting a malicious payload via the API endpoint without needing valid credentials for the target SSH server or gateway.
From a technical perspective, the root cause lies in how paramiko handles the proxy_command argument when instantiated within the std.ssh_proxied action. Paramiko typically treats this string as a shell command to be executed by subprocess modules on the local machine where the library is running. In OpenStack Mistral's default configuration, the executor service runs under a specific system account that possesses sufficient privileges to execute these injected commands. Because there are no restrictions on special characters or command chaining within the proxy_command field, an attacker can leverage shell metacharacters such as semicolons, pipes, or ampersands to chain multiple commands or escape any intended context. This effectively transforms a configuration parameter into a full-blown remote code execution vector, bypassing authentication checks for the target SSH host entirely and relying solely on the lower-level privilege of the Mistral executor service account.
The operational impact of this vulnerability is severe, as it grants an authenticated user with project-level access the ability to compromise the underlying infrastructure hosting the OpenStack control plane components. By executing arbitrary commands, a malicious actor can read sensitive configuration files, exfiltrate credentials stored on the executor host, pivot into other internal network segments accessible by that host, or install persistent backdoors within the Mistral execution environment. This undermines the fundamental security boundary between tenant workloads and the orchestration infrastructure, potentially leading to full cluster compromise if the executor host is integrated with critical management interfaces or storage systems. The default configuration of OpenStack Mistral permits this action for all users by design, meaning that any deployment utilizing standard settings without explicit hardening measures against this specific vector is immediately exploitable upon authentication.
To mitigate this risk, administrators must implement strict input validation on the proxy_command parameter within custom implementations if they rely heavily on proxied SSH actions, although given the depth of integration with paramiko, complete isolation via containerization or sandboxing of Mistral executors is recommended. Upgrading to a patched version of OpenStack Mistral that addresses this specific command injection flaw in the std.ssh_proxied action is essential for long-term security posture. Additionally, organizations should review their IAM policies to ensure that only trusted administrators have access to execute actions within the orchestration engine, applying the principle of least privilege to restrict who can trigger high-privilege infrastructure operations. Monitoring logs for unusual subprocess activity originating from the Mistral executor service account can also aid in detecting exploitation attempts before significant damage occurs.
This vulnerability aligns with Common Weakness Enumeration CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection, due to the failure to neutralize special elements that could alter command structure. It is further categorized under ATT&CK technique T1059 Command and Scripting Interpreter, specifically reflecting how attackers leverage system utilities or interpreters to execute arbitrary code on a compromised host. The scenario also reflects aspects of CWE-20 Improper Input Validation where the application accepts user input without sufficient verification that it conforms to expected formats or constraints before processing.