CVE-2026-28370 json
OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection
published 2026-02-27 8 mo ago modified 2026-07-02 4 mo ago also GHSA-8xwf-cr4r-856r , PYSEC-2026-564 , EUVD-2026-8999
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.
Patch / fix
- pypi vitrage 12.0.1, 13.0.1, 14.0.1, 15.0.1
- OpenStack Vitrage 12.0.1
- vitrage Debian 12 9.0.0-3+deb12u1
- vitrage Debian 13 14.0.0-4+deb13u1
debian advisories DEBIAN-CVE-2026-28370
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 8 mo ago
Exploit prediction
0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- storyboard.openstack.org https://storyboard.openstack.org/#%21/story/2011539 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| OSV | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | vitrage | >=15.0.0.0rc1, <15.0.1 >=14.0.0.0rc1, <14.0.1 >=13.0.0.0rc1, <13.0.1 <12.0.1 |
15.0.1 14.0.1 13.0.1 12.0.1 |
Affected products
- OpenStack Vitrage
Classification
- Weakness
-
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code
References
-
github.com
/openstack/vitrage/commit/89df4bd2ffda1a5ddea66cd828438a6a171a3b11
web
-
storyboard.openstack.org
/#%21/story/2011539
web, exploit, issue-tracking, vendor-advisory
-
github.com
/openstack/vitrage/blob/a1f86950e1314b0c740f9cd9b7e9dbab7d02af51/vitrage/graph/query.py#L70
web, issue-tracking
-
openwall.com
/lists/oss-security/2026/03/03/6
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-28370
advisory
-
github.com
/openstack/vitrage
web
-
pypi.org
/project/vitrage
package
-
github.com
/advisories/GHSA-8xwf-cr4r-856r
advisory
Sources
- CVE List CVE-2026-28370
- GitHub Advisory GHSA-8xwf-cr4r-856r
- NVD CVE-2026-28370
- OSV PYSEC-2026-564
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.