CVE-2026-28370 - Vulnerability Analysis

Overview

OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0 contains a remote code execution caused by unsafe query parsing in _create_query_function, letting users with Vitrage API access execute code as the service user.

Severity & Score

Impact

Users with Vitrage API access can execute code on the host, potentially leading to full service compromise and unauthorized host access.

Mitigation

Upgrade to versions 12.0.1, 13.0.0, 14.0.0, 15.0.0 or later.

References

• https://github.com/openstack/vitrage/blob/a1f86950e1314b0c740f9cd9b7e9dbab7d02af51/vitrage/graph/query.py#L70
• https://storyboard.openstack.org/#%21/story/2011539

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner