Control: tag -1 pending Hello,
Bug #1150346 in mistral reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/mistral/-/commit/ed3ee5d177acbb8b7427ed6e89e786635b167c49 ------------------------------------------------------------------------ * OSSA-2026-044: Four authorization and privilege vulnerabilities in Mistral, with the details as per below (Closes: #1150346). * CVE-2026-97147: several of Mistral's v2 API write paths resolve the target object with a query that can return another project's resource, then write to it (CVE-2026-97147). An authenticated project member can use this to rewrite and un-publish another project's public action definitions and environments. A project administrator can create a workbook whose embedded ad-hoc action or workflow name collides with a resource of another project, which moves that resource into the caller's project and causes the original owner's subsequent updates of it to fail with server errors. All deployments exposing the Mistral API are affected. Applied upstream patches: "Fix create-or-update of definitions hijacking other projects' rows", "Enforce access control when updating action definitions", "Enforce access control when updating workbooks and environments", "Resolve own-project object when updating code sources / dynamic actions", "Resolve own-project cron trigger in create_or_update_cron_trigger": - CVE-2026-97147_Fix_create-or-update_of_definitions_hijacking_oth....patch - CVE-2026-97147_Enforce_access_control_when_updating_action_defin....patch - CVE-2026-97147_Enforce_access_control_when_updating_workbooks_an....patch - CVE-2026-97147_Resolve_own-project_object_when_updating_code_sou....patch - CVE-2026-97147_Resolve_own-project_cron_trigger_in_create_or_upd....patch Added my own patch to fix unit test: - CVE-2026-97147_Resolve_own-project_object_Fix-test-DB-cleanup-fo....patch * CVE-2026-93861: Mistral's workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project (CVE-2026-93861). The new membership row is created with its project_id defaulted to the accepting project rather than the original workflow owner, so the owner can neither see nor delete it. The third project can accept this membership it was never actually granted by the owner, then read and execute the owner's private workflow; only the accepting (not the owning) project can later revoke that access. Applied upstream patch: "Only allow the owner of a resource to share it": - CVE-2026-93861_Only_allow_the_owner_of_a_resource_to_share_it.patch * CVE-2026-93858: Mistral's ssh_proxied action provider (CVE-2026-93858). By supplying a specially-crafted action payload, an unprivileged authenticated user may override paramiko's proxy_command resulting in execution of arbitrary code on the executor host operating system. Only Mistral deployments allowing the std.ssh_proxied action provider (the default) are affected. Applied upstream patch: "Fix RCE via std.ssh_proxied proxy_command": - CVE-2026-93858_Fix_RCE_via_std.ssh_proxied_proxy_command.patch * CVE-2026-93860: vulnerability in Mistral's maintenance API method. By calling the maintenance API method, an unprivileged authenticated user may pause processing for creation of new objects for all tenant projects resulting in a temporary denial of service. All Mistral deployments are affected. Applied upstream patch: "Restrict the maintenance endpoint to admins": - CVE-2026-93860_Restrict_the_maintenance_endpoint_to_admins.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1150346
