Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-93858 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an arbitrary local command as proxy_command; paramiko starts that command as a subprocess on the executor host under the executor's own service account, independent of whether the SSH connection itself ever succeeds. Only Mistral deployments that permit the std.ssh_proxied action, the default configuration, are affected.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.8 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://launchpad.net/bugs/2162100	CISA-ADP	ExploitIssue TrackingTechnical DescriptionVendor
https://launchpad.net/bugs/2162100	[email protected]	ExploitIssue TrackingTechnical DescriptionVendor
https://security.openstack.org/ossa/OSSA-2026-044.html	[email protected]	AdvisoryBundleRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	[email protected]

Affected Products

Product	Versions
OpenStack Mistral	< 20.1.1 (semver) = 21.0.0 (semver) = 22.0.0 (semver) = 23.0.0 (semver)
CPE cpe:2.3:a:redhat:openstack-mistral:::::::: Remediation Workaround:low effort Disable the std.ssh_proxied action by adding the following configuration: [legacy_action_provider] denylist = std.ssh_proxied [action_provider] denylist = std.ssh_proxied Patch: (master)moderate efforthttps://review.opendev.org/c/openstack/mistral/+/1009474 Patch: (stable/2026.2)moderate efforthttps://review.opendev.org/c/openstack/mistral/+/1009482 Patch: (stable/2026.1)moderate efforthttps://review.opendev.org/c/openstack/mistral/+/1009490 Patch: (stable/2025.2)moderate efforthttps://review.opendev.org/c/openstack/mistral/+/1009499 Patch: (stable/2025.1)moderate efforthttps://review.opendev.org/c/openstack/mistral/+/1009508

Product

Versions

OpenStack Mistral

< 20.1.1 (semver)

= 21.0.0 (semver)

= 22.0.0 (semver)

= 23.0.0 (semver)

CPE

cpe:2.3:a:redhat:openstack-mistral:*:*:*:*:*:*:*:*

Remediation

Workaround:low effort
Disable the std.ssh_proxied action by adding the following configuration: [legacy_action_provider] denylist = std.ssh_proxied [action_provider] denylist = std.ssh_proxied
Patch: (master)moderate efforthttps://review.opendev.org/c/openstack/mistral/+/1009474
Patch: (stable/2026.2)moderate efforthttps://review.opendev.org/c/openstack/mistral/+/1009482
Patch: (stable/2026.1)moderate efforthttps://review.opendev.org/c/openstack/mistral/+/1009490
Patch: (stable/2025.2)moderate efforthttps://review.opendev.org/c/openstack/mistral/+/1009499
Patch: (stable/2025.1)moderate efforthttps://review.opendev.org/c/openstack/mistral/+/1009508

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 8, 2026	New CVE Received	[email protected]
Oct 8, 2026	CVE Modified	CISA-ADP