CVSS 8.7: OpenStack Mistral SSH Proxy Flaw Lets Members Execute Code Without SSH Connection

An authenticated project member can execute arbitrary local commands on OpenStack Mistral executor hosts through a command injection vulnerability identified as CVE-2026-93858. The National Vulnerability Database assigned the flaw a CVSS score of 8.7, classifying it as high severity.

The vulnerability exists within the std.ssh_proxied action, which passes user-supplied proxy_command values directly to the paramiko.ProxyCommand() function. This occurs before any attempt is made to establish an SSH connection to a gateway or target host.

Technical Context

According to the NVD record, the flaw stems from insufficient input validation in the OpenStack Mistral component. An attacker uses the standard action-execution API to submit a malicious local command as the proxy_command parameter. The paramiko library then starts this command as a subprocess on the executor host.

This execution happens under the executor's own service account. The attack succeeds regardless of whether the subsequent SSH connection to the intended remote host actually succeeds or fails. This separation between command execution and connection success makes the flaw particularly dangerous for infrastructure security.

Affected Versions

The vulnerability impacts OpenStack Mistral deployments running specific versions. Affected releases include versions prior to 20.1.1, prior to 21.0.1, prior to 22.0.1, and the specific release 23.0.0.

Organizations using the default configuration are at risk because the std.ssh_proxied action is permitted by default. The oss-security mailing list advisory, posted by Jeremy Stanley on October 8, 2026, groups this issue with three other authorization and privilege vulnerabilities in Mistral.

Defender's checklist

Security teams should immediately audit their OpenStack Mistral environments to determine if the std.ssh_proxied action is enabled. Administrators must check the version of their Mistral installation against the affected list provided by the vendor.

If the deployment uses a vulnerable version, teams should restrict access to the action-execution API for project members. Monitoring logs for unexpected subprocess activity on executor hosts can help detect exploitation attempts before significant damage occurs.

What to do and how to stay safe: OpenStack

• Verify your OpenStack Mistral version against the affected list: before 20.1.1, before 21.0.1, before 22.0.1, and 23.0.0.
• Disable the std.ssh_proxied action in your Mistral configuration if it is not strictly required for your current workflows.
• Monitor executor host logs for unauthorized subprocess creation or unexpected command execution under the service account.
• Review API access controls to ensure only trusted administrators can trigger actions that involve external connections.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability require unauthenticated access?

No, the attacker must be an authenticated project member with access to the standard action-execution API.

Is a successful SSH connection required to exploit this flaw?

No, the arbitrary command runs locally on the executor host independently of whether the SSH connection succeeds.

Which OpenStack Mistral versions are affected by CVE-2026-93858?

Versions before 20.1.1, before 21.0.1, before 22.0.1, and version 23.0.0 are affected.