CVE-2026-97147

What it is

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and environments. A project administrator can create a workbook whose embedded ad-hoc action or workflow name collides with a resource of another project, which moves that resource into the caller's project and causes the original owner's subsequent updates of it to fail with server errors. Only deployments exposing the Mistral API are affected.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data tampering.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-10-08 18:18 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-14 01:17 UTC Last updatedMost recent change to the record

Details

Published

2026-10-08 18:18 UTC

Last modified

2026-10-14 01:17 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-863 · Incorrect authorization

Record status

Deferred

Attack profile CVSS 4.0 · 7.2

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

Low

User interaction

None

Confidentiality

Low

Integrity

High

Availability

Low