CVE-2026-93858: OpenStack Mistral RCE Vulnerability

CVE-2026-93858 Overview

CVE-2026-93858 is a command injection vulnerability in OpenStack Mistral through version 23.0.0. The std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() without validation. An authenticated project member can submit arbitrary local commands through the standard action-execution API. Paramiko launches the supplied value as a subprocess on the executor host under the executor service account. Command execution occurs regardless of whether the downstream SSH connection succeeds. The flaw affects any Mistral deployment that permits the std.ssh_proxied action, which is the default configuration. The vulnerability is tracked under CWE-78, OS Command Injection.

Critical Impact

Any authenticated project member can execute arbitrary operating system commands on the Mistral executor host as the executor service account, enabling lateral movement across the OpenStack control plane.

Affected Products

• OpenStack Mistral versions up to and including 23.0.0
• Mistral deployments with the std.ssh_proxied action enabled (default)
• OpenStack environments exposing the Mistral action-execution API to project members

Discovery Timeline

• 2026-10-08 - CVE-2026-93858 published to the National Vulnerability Database
• 2026-10-08 - OpenStack Security Advisory OSSA-2026-044 issued
• 2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-93858

Vulnerability Analysis

Mistral is the OpenStack workflow service that executes user-defined tasks on behalf of tenants. The std.ssh_proxied built-in action is designed to open an SSH session to a target host through an intermediate gateway using Paramiko's ProxyCommand facility. Paramiko's ProxyCommand wraps subprocess.Popen and launches whatever string it receives through a shell on the local machine. Because Mistral forwards the user-supplied proxy_command argument into this call without sanitization or allow-listing, the action functions as a thin wrapper around arbitrary command execution. The subprocess runs under the identity of the Mistral executor service, which typically holds credentials to the message bus, the state database, and other control-plane services.

Root Cause

The root cause is missing input validation on an action parameter that is passed to an API with shell semantics. The std.ssh_proxied implementation treats proxy_command as an opaque transport string rather than untrusted input. No allow-list of binaries, no argument escaping, and no sandboxing surround the subprocess invocation. The CWE-78 classification reflects the direct composition of attacker-controlled data into an operating system command.

Attack Vector

Exploitation requires only valid project-member credentials and network access to the Mistral API. An attacker submits an action execution for std.ssh_proxied with a crafted proxy_command such as a reverse shell, a credential dumper reading /etc/mistral/mistral.conf, or a command that queries the OpenStack metadata service. The payload executes before any SSH handshake, so the attacker does not need a reachable gateway or target host. Repeated submissions can establish persistence or stage follow-on attacks against RabbitMQ, Keystone, and the Mistral database.

No verified public exploit code is available at this time. See the Launchpad bug report for upstream technical discussion.

Detection Methods for CVE-2026-93858

Indicators of Compromise

• Mistral action-execution API requests invoking std.ssh_proxied with unusual proxy_command values containing shell metacharacters, pipes, or binaries unrelated to nc, ssh, or socat
• Child processes of the Mistral executor process (mistral-executor) that are not SSH clients, such as bash, python, curl, or wget
• Outbound network connections from executor hosts to IP addresses outside the documented SSH gateway inventory
• Reads of sensitive files such as /etc/mistral/mistral.conf, /root/.ssh/, or cloud instance metadata endpoints by processes parented to the executor

Detection Strategies

• Enable Mistral API audit logging and alert on std.ssh_proxied action executions, correlating the submitting project with expected automation accounts
• Deploy host-based process monitoring on executor nodes to flag non-SSH child processes of mistral-executor
• Baseline outbound connections from executor hosts and alert on deviations, since legitimate ProxyCommand traffic is predictable

Monitoring Recommendations

• Forward Mistral API logs, executor host process telemetry, and OpenStack audit events to a centralized analytics platform for correlation
• Monitor Keystone token issuance for project members that suddenly begin invoking workflow actions they have not used previously
• Track execution counts of std.ssh_proxied per project and alert on rate anomalies

How to Mitigate CVE-2026-93858

Immediate Actions Required

• Disable the std.ssh_proxied action in the Mistral configuration until a patched version is deployed
• Restrict network access to the Mistral API to trusted automation subnets and remove it from general tenant reach where possible
• Rotate credentials stored on executor hosts, including SSH keys, service account tokens, and configuration file secrets
• Audit recent action_executions records for any invocation of std.ssh_proxied and investigate unexpected proxy_command values

Patch Information

Refer to OpenStack Security Advisory OSSA-2026-044 for the authoritative list of fixed Mistral releases and backports. Upgrade all Mistral API and executor services beyond version 23.0.0 to the fixed release identified in the advisory.

Workarounds

• Remove std.ssh_proxied from the allowed actions list in mistral.conf using the [engine] action_packs or policy configuration appropriate to the deployment
• Apply a RBAC policy that restricts action-execution submission to a narrow set of trusted service accounts
• Run mistral-executor under a dedicated low-privilege user with no access to control-plane credentials, and apply systemd or AppArmor confinement to limit subprocess capabilities

# Example: disable std.ssh_proxied by overriding policy and verifying
# Edit /etc/mistral/policy.yaml to deny the action for non-admin roles
"action:std.ssh_proxied": "role:admin"

# Restart the Mistral services to apply the policy
systemctl restart mistral-api mistral-engine mistral-executor

# Verify the action is no longer executable by a project member
openstack action execution create std.ssh_proxied \
  '{"cmd":"true","host":"example","username":"u","proxy_command":"nc gw 22"}'
# Expected result: HTTP 403 Forbidden