CVE-2026-28370

Katalog CVE

CVSS 9.1 · Critical EPSS 0,82%

Kerentanan Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') pada openstack vitrage. Skor CVSS 3.1 9.1 (Critical) menurut mitre.org.

Deskripsi (NVD)

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 56,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://storyboard.openstack.org/#%21/story/2011539 exploit · issue tracking · advisory vendor
• https://github.com/openstack/vitrage/blob/a1f86950e1314b0c740f9cd9b7e9dbab7d02af51/vitrage/graph/query.py#L70 issue tracking
• http://www.openwall.com/lists/oss-security/2026/03/03/6