OpenStack Mistral Fixes Command Injection in SSH Proxy Action

OpenStack Mistral contains a high-severity command injection vulnerability that allows authenticated users to execute arbitrary local commands on infrastructure executor hosts. The flaw, tracked as CVE-2026-93858, affects versions of the workflow engine up to and including 23.0.0.

According to the National Vulnerability Database, the issue stems from how the `std.ssh_proxied` action handles input. The action passes a caller-supplied `proxy_command` value directly to `paramiko.ProxyCommand()` before establishing any SSH connection to a gateway or target host. An attacker with an authenticated project member account can use the standard action-execution API to submit a malicious local command as the `proxy_command`. The `paramiko` library then starts this command as a subprocess on the executor host under the executor's own service account. This execution occurs independently of whether the subsequent SSH connection attempt succeeds or fails.

Context and Background

The vulnerability was detailed in an advisory posted to the oss-security mailing list on October 8, 2026. Titled "[OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral," the advisory lists CVE-2026-93858 alongside three other issues: CVE-2026-93860, CVE-2026-93861, and CVE-2026-97147. Jeremy Stanley posted the advisory, which attributes the discovery to Arnaud Morin.

The CVSS score of 8.7 classifies the severity as High. The underlying weakness is identified as CWE-78, which relates to improper neutralization of special elements used in an OS command. Because the command execution happens on the executor host under the service account's privileges, successful exploitation could allow an attacker to compromise the underlying infrastructure node running the Mistral executor service.

Who Is Affected

According to the NVD record, OpenStack Mistral versions prior to 20.1.1, prior to 21.0.1, prior to 22.0.1, and version 23.0.0 are affected. The oss-security advisory specifies the affected versions as those before 20.1.1, version 21.0.0, version 22.0.0, and version 23.0.0.

The vulnerability only impacts Mistral deployments that permit the `std.ssh_proxied` action. This permission is enabled in the default configuration for Mistral. Therefore, most standard installations are potentially vulnerable unless administrators have explicitly disabled this specific action. The flaw requires the attacker to have an authenticated project member role, meaning it is not exploitable by unauthenticated external actors.

What should you do?

Administrators should verify their Mistral version against the affected list. If running a vulnerable version, they should check if the `std.ssh_proxied` action is enabled. Since no patch or update has been confirmed in the provided material, operators should consider restricting access to the action-execution API for the `std.ssh_proxied` action if immediate upgrading is not possible. Monitor logs on executor hosts for unexpected subprocess executions under the service account.