CVE-2026-93858

A flaw was found in OpenStack Mistral. The std.sshproxied built-in action accepts a user-supplied proxycommand parameter that is passed without validation to a system subprocess call on the Mistral executor host. An authenticated attacker can craft a malicious workflow that supplies an arbitrary...