CVE-2026-28370

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/openstack/vitrage/blob/a1f86950e1314b0c740f9cd9b7e9dbab7d02af51/vitrage/graph/query.py#L70	Issue Tracking
https://storyboard.openstack.org/#%21/story/2011539	Exploit Issue Tracking Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/03/6

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openstack:vitrage::::::::
	cpe:2.3:a:openstack:vitrage::::::::
	cpe:2.3:a:openstack:vitrage::::::::
	cpe:2.3:a:openstack:vitrage::::::::

History

No history.

Information

Published : 2026-02-27 05:18

Updated : 2026-03-05 05:16

NVD link : CVE-2026-28370

Mitre link : CVE-2026-28370

CVE.ORG link : CVE-2026-28370

JSON object : View

Products Affected

openstack

vitrage

CWE

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

{"id": "CVE-2026-28370", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2026-02-27T05:18:20.757", "references": [{"url": "https://github.com/openstack/vitrage/blob/a1f86950e1314b0c740f9cd9b7e9dbab7d02af51/vitrage/graph/query.py#L70", "tags": ["Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://storyboard.openstack.org/#%21/story/2011539", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/03/03/6", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-95"}]}], "descriptions": [{"lang": "en", "value": "In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py."}, {"lang": "es", "value": "En el analizador de consultas de OpenStack Vitrage antes de las versiones 12.0.1, 13.0.0, 14.0.0 y 15.0.0, un usuario con permiso para acceder a la API de Vitrage podr\u00eda desencadenar la ejecuci\u00f3n de c\u00f3digo en el host del servicio Vitrage como el usuario bajo el cual se ejecuta el servicio Vitrage. Esto podr\u00eda resultar en acceso no autorizado al host y un compromiso adicional del servicio Vitrage. Todas las implementaciones que exponen la API de Vitrage se ven afectadas. Esto ocurre en _create_query_function en vitrage/graph/query.py."}], "lastModified": "2026-03-05T05:16:37.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:vitrage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "819FA93C-959C-4AF7-B901-F84A7300387E", "versionEndExcluding": "12.01"}, {"criteria": "cpe:2.3:a:openstack:vitrage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08776A5E-89BE-4C75-A80D-144381B2B783", "versionEndExcluding": "13.0.1", "versionStartIncluding": "13.0.0"}, {"criteria": "cpe:2.3:a:openstack:vitrage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "085F48A1-4497-48BD-87DC-662CFF9D209F", "versionEndExcluding": "14.0.1", "versionStartIncluding": "14.0.0"}, {"criteria": "cpe:2.3:a:openstack:vitrage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FBEE245-024B-4950-B5CD-9B0B9AB40847", "versionEndExcluding": "15.0.1", "versionStartIncluding": "15.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}