OpenStack Mistral up to 20.1.0/21.0.0/22.0.0/23.0.0 V2 API Write Paths access control

Summaryinfo

A vulnerability has been found in OpenStack Mistral up to 20.1.0/21.0.0/22.0.0/23.0.0 and classified as critical. The affected element is an unknown function of the component V2 API Write Paths. Performing a manipulation results in access control. This vulnerability is cataloged as CVE-2026-97147. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in OpenStack Mistral up to 20.1.0/21.0.0/22.0.0/23.0.0. It has been classified as critical. This affects an unknown part of the component V2 API Write Paths. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and environments. A project administrator can create a workbook whose embedded ad-hoc action or workflow name collides with a resource of another project, which moves that resource into the caller's project and causes the original owner's subsequent updates of it to fail with server errors. Only deployments exposing the Mistral API are affected.

The advisory is shared at launchpad.net. This vulnerability is uniquely identified as CVE-2026-97147 since 09/24/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 20.1.1, 21.0.1 or 22.0.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Cloud Software

Vendor

• OpenStack

Name

• Mistral

Version

• 20.0
• 20.1.0
• 21.0
• 22.0
• 23.0

License

• free

Website

• Vendor: https://www.openstack.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion