CVE catalog

CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The

[CVE catalog]

Severity: Medium · CVSS 6CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Oct 8, 2026, 5:38:43 PM UTC
Updated: Oct 8, 2026, 6:18:31 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.26% · Oct 25, 2026

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its project_id defaulted to the accepting project rather than the original workflow owner, and thus the owner can neither see nor delete it. The third project can accept this membership (that it had not actually been granted by the owner), and then read and execute the owner's private workflow; only the accepting (not the owning) project can later revoke that access.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	mistral	sid	`23.0.0-4`	fixed
Debian	mistral	forky	`23.0.0-2`	fixed
Debian	mistral	trixie	`20.0.0-2+deb13u1`	vulnerable
Debian	mistral	trixie-security	`20.0.0-2+deb13u1`	vulnerable
Debian	mistral	bookworm	`15.0.0-1+deb12u1`	vulnerable
Debian	mistral	bookworm-security	`15.0.0-1+deb12u1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	mistral	source	sid	`23.0.0-2`	not yet assigned	Not reported	[1150346]
Debian	mistral	source	forky	`23.0.0-2`	not yet assigned	Not reported	[1150346]
Debian	mistral	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1150346]
Debian	mistral	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1150346]

[Debian bug #1150346]

Notes

[trixie] mistral: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[mistral-api]Affected
Source package: [mistral]
Details (4)
- 15.0.0-1+deb12u1 · all · bookworm
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm-security
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm-security
  Affected
  nvd · mistral · debian · bookworm
[mistral-common]Affected
Source package: [mistral]
Details (4)
- 15.0.0-1+deb12u1 · all · bookworm
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm-security
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm-security
  Affected
  nvd · mistral · debian · bookworm
[mistral-engine]Affected
Source package: [mistral]
Details (4)
- 15.0.0-1+deb12u1 · all · bookworm
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm-security
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm-security
  Affected
  nvd · mistral · debian · bookworm
[mistral-event-engine]Affected
Source package: [mistral]
Details (4)
- 15.0.0-1+deb12u1 · all · bookworm
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm-security
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm-security
  Affected
  nvd · mistral · debian · bookworm
[mistral-executor]Affected
Source package: [mistral]
Details (4)
- 15.0.0-1+deb12u1 · all · bookworm
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm-security
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm-security
  Affected
  nvd · mistral · debian · bookworm
[python3-mistral]Affected
Source package: [mistral]
Details (4)
- 15.0.0-1+deb12u1 · all · bookworm
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm-security
  Affected
  nvd · mistral · debian · bookworm
- 15.0.0-1+deb12u1 · all · bookworm-security
  Affected
  nvd · mistral · debian · bookworm

Observed: Oct 27, 2026, 4:45:50 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]