OpenStack Mistral: OS command injection in std.ssh_proxied action
Summary
The std.ssh_proxied action in OpenStack Mistral passes a caller-supplied proxy_command value directly to paramiko before any SSH connection is attempted. An authenticated project member can use this to run an arbitrary local command on the executor host under the executor's service account, even if the SSH connection never succeeds. Only deployments that permit the std.ssh_proxied action, the default configuration, are affected.
Affected
- OpenStack Mistral before 20.1.1
- OpenStack Mistral 21.0.0 before 21.0.1
- OpenStack Mistral 22.0.0 before 22.0.1
- OpenStack Mistral 23.0.0: listed as affected. The CNA record marks the default configuration as unaffected, while the advisory says deployments allowing std.ssh_proxied (the default) are affected. Clarify with the vendor.
Fixed in
- 20.1.1
- 21.0.1
- 22.0.1
- Fixed version for 23.x: Unknown.
Workaround
- No vendor workaround documented.
- Analyst recommendation: until patched, restrict or disable the std.ssh_proxied action and limit who can create action executions. Check the impact first, as the action is used for VM maintenance workflows.
Exploitation
- CISA SSVC lists exploitation as poc (proof of concept exists); automatable: no.
- No exploitation in the wild found; not checked against the CISA KEV catalog.
- EPSS 0.00428 (low predicted exploitation probability).
Our recommendation
- Patch OpenStack Mistral to 20.1.1, 21.0.1 or 22.0.1 as applicable, and check the vendor advisory for 23.x.
- Until patched, restrict or disable std.ssh_proxied and review who can create action executions.
- Check whether any OpenStack/Mistral installation is reachable by tenants or project members.
- Monitor executor hosts for unexpected subprocesses.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Launchpad bug 2162100 launchpad.net
- OpenStack Security Advisory OSSA-2026-044 security.openstack.org
- Ubuntu CVE-2026-93858 ubuntu.com
- OSV DEBIAN-CVE-2026-93858 osv.dev
- Strix CVE-2026-93858 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:15.
Original description (NVD)
In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an arbitrary local command as proxy_command; paramiko starts that command as a subprocess on the executor host under the executor's own service account, independent of whether the SSH connection itself ever succeeds. Only Mistral deployments that permit the std.ssh_proxied action, the default configuration, are affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.