Key points
- CVE-2026-93858 is rated High severity with a CVSS score of 8.7.
- The vulnerability affects OpenStack Mistral versions up to and including 23.0.0.
- Exploitation requires an authenticated project member and the default configuration.
An authenticated user can execute arbitrary local commands on OpenStack Mistral executor hosts through a command injection vulnerability in the `std.ssh_proxied` action. The flaw, tracked as CVE-2026-93858, allows attackers to bypass intended SSH proxy constraints and run code under the executor’s service account.
The issue arises because the action passes a caller-supplied `proxy_command` value directly to `paramiko.ProxyCommand()` before any SSH connection to a gateway or target host is attempted. According to the National Vulnerability Database, an attacker can use the standard action-execution API to submit an arbitrary local command as the `proxy_command`. The `paramiko` library then starts this command as a subprocess on the executor host. This execution occurs independently of whether the subsequent SSH connection actually succeeds.
Context and Background
The vulnerability was detailed in advisory OSSA-2026-044, posted to the oss-security mailing list on 8 October 2026. Authored by Jeremy Stanley, the advisory groups CVE-2026-93858 with three other authorisation and privilege vulnerabilities: CVE-2026-93860, CVE-2026-93861, and CVE-2026-97147. While the advisory lists four distinct CVEs, the National Vulnerability Database provides specific technical details only for CVE-2026-93858, classifying it under CWE-78 (Improper Neutralisation of Special Elements used in an OS Command). The CVSS v3.1 base score of 8.7 places this flaw in the High severity category.
Who Is Affected
Organisations running OpenStack Mistral are affected if they are using versions prior to 20.1.1, prior to 21.0.1, prior to 22.0.1, or version 23.0.0. The advisory specifically notes that versions 21.0.0, 22.0.0, and 23.0.0 are vulnerable. The risk is present in deployments that permit the `std.ssh_proxied` action, which is the default configuration. An attacker requires the privileges of an authenticated project member to exploit this vulnerability. Once executed, the malicious command runs under the executor’s own service account, potentially granting the attacker significant control over the host system.
Our take on the response
The immediate risk for organisations using default Mistral configurations is significant due to the ease of exploitation. An authenticated user does not need to successfully establish an SSH connection to trigger the code execution; the subprocess launch happens before the connection attempt. Security teams should verify their Mistral versions against the affected list immediately. If a vendor patch is available for your specific version, apply it urgently. If not, consider restricting access to the `std.ssh_proxied` action or disabling it entirely if it is not required for your operations.
Background: Command injection
Look for unexpected process spawns, anomalous outbound connections, and slight delays in application responses. Check logs for shell metacharacters like semicolons or pipes. Validate all inputs strictly and isolate execution environments immediately.
Read the full guide: Command Injection Warning Signs: Detect Silent Backdoors
What to do and how to stay safe: OpenStack
- Inventory all OpenStack Mistral deployments to identify versions before 20.1.1, 21.0.1, 22.0.1, or equal to 23.0.0.
- Review API logs for unusual action-execution requests involving the `std.ssh_proxied` action from authenticated project members.
- Restrict or disable the `std.ssh_proxied` action in your Mistral configuration if it is not essential for your workflows.
- Monitor for unexpected subprocess activity on executor hosts, particularly processes spawned under the service account that do not correspond to legitimate SSH connections.
Step-by-step guide: Out-of-Band Patches: How Emergency Updates Prevent Downtime
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-93858?
The CVSS score is 8.7, which is classified as High severity.
Which OpenStack Mistral versions are vulnerable?
Versions before 20.1.1, before 21.0.1, before 22.0.1, and version 23.0.0 are affected.
Does an attacker need to be an administrator to exploit this?
No, an authenticated project member can exploit this vulnerability using the standard action-execution API.