DEBIAN-CVE-2026-28370
In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.
DEBIAN-CVE-2026-28370
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-28370
vitrage
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 9.0.0-3+deb12u1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
vitrage
Source reference: /affected/1/package/name
- Affected versions
- 14.0.0-4
Source reference:
/affected/1/versions - Fixed versions
- 14.0.0-4+deb13u1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.0-3+deb12u1"
}
]
}
],
"package": {
"name": "vitrage",
"purl": "pkg:deb/debian/vitrage?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-28370.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.0.0-4+deb13u1"
}
]
}
],
"package": {
"name": "vitrage",
"purl": "pkg:deb/debian/vitrage?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"14.0.0-4"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-28370.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56633 · Revision 1
- Added to Heist Feed
- Publisher date