CVE-2026-97147
In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and environments. A project administrator can create a workbook whose embedded ad-hoc action or workflow name collides with a resource of another project, which moves that resource into the caller's project and causes the original owner's subsequent updates of it to fail with server errors. Only deployments exposing the Mistral API are affected.
CVE-2026-97147
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-97147
Mistral
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://opendev.org/openstack/mistral",
"vendor": "OpenStack",
"product": "Mistral",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "20.1.1",
"versionType": "semver"
},
{
"status": "affected",
"version": "21.0.0",
"lessThan": "21.0.1",
"versionType": "semver"
},
{
"status": "affected",
"version": "22.0.0",
"lessThan": "22.0.1",
"versionType": "semver"
},
{
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-97147
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #21327 · Revision 1
- Added to Heist Feed
- Publisher date