CVE-2026-93858

In OpenStack Mistral versions through 23.0.0 , the std.ssh_proxied action is vulnerable to OS Command Injection (CWE-78). The issue occurs because the system passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before establishing an SSH connection. An authenticated pr...

EUVD-2026-95121

In OpenStack Mistral through 23.0.0, the std.sshproxied action passes a caller-supplied proxycommand value directly to paramiko.ProxyCommand before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an...