Every CVESearch/Get API key

CVE-2026-28370

OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection

9.1 CriticalFix available

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.85%Up 0.8 points since Feb 27, 2026
90%50%10%1%

What each source reports

CVE List Score used9.1

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Record
CVE-2026-28370
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-95
Updated
2026-11-02
EUVDEUVD-2026-89999.1

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Record
EUVD-2026-8999
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-8xwf-cr4r-856r9.1

OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Record
GHSA-8xwf-cr4r-856r
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-95
Updated
2026-11-02
NVD9.1

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Record
CVE-2026-28370
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-95
Updated
2026-11-02
OSV9.1

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Record
CVE-2026-28370
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-95
Updated
2026-11-02
OSVDEBIAN-CVE-2026-283709.1

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Record
DEBIAN-CVE-2026-28370
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-8xwf-cr4r-856r9.1

OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Record
GHSA-8xwf-cr4r-856r
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-95
Updated
2026-11-02
OSVPYSEC-2026-5649.1

OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Record
PYSEC-2026-564
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-283709.1

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Record
UBUNTU-CVE-2026-28370
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vitrage
PyPI
15.0.0.0rc1 up to 15.0.1
15.0.1
vitrage
PyPI
14.0.0.0rc1 up to 14.0.1
14.0.1
vitrage
PyPI
13.0.0.0rc1 up to 13.0.1
13.0.1
vitrage
PyPI
before 12.0.1
12.0.1
vitrage
Debian:12
before 9.0.0-3+deb12u1
9.0.0-3+deb12u1
vitrage
Debian:13
before 14.0.0-4+deb13u1, plus listed versions
14.0.0-4
14.0.0-4+deb13u1
vitrage
PyPI
15.0.0.0rc1 up to 15.0.1, plus listed versions
15.0.0
15.0.1
vitrage
PyPI
14.0.0.0rc1 up to 14.0.1, plus listed versions
14.0.0
14.0.1
vitrage
PyPI
13.0.0.0rc1 up to 13.0.1, plus listed versions
13.0.0
13.0.1
vitrage
PyPI
before 12.0.1, plus listed versions
0.0.1.dev4510.2.00.7.01.0.01.1.0
Show 45 moreShow less
1.2.01.3.01.4.01.5.01.5.11.5.21.6.01.7.01.8.01.8.11.8.21.8.310.0.010.0.0.0rc111.0.011.0.0.0rc112.0.012.0.0.0rc112.0.0.0rc22.0.02.1.02.2.02.3.03.0.03.1.03.2.03.3.04.0.04.1.04.2.04.3.04.3.14.3.25.0.05.0.15.0.26.0.06.0.17.0.07.1.07.2.07.3.07.4.07.5.08.0.0
12.0.1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
vitrage
PyPI
before 12.0.1, 13.0.0.0rc1 up to 13.0.1, 14.0.0.0rc1 up to 14.0.1, 15.0.0.0rc1 up to 15.0.1, plus listed versions
0.0.1.dev4510.2.00.7.01.0.01.1.0
Show 45 moreShow less
1.2.01.3.01.4.01.5.01.5.11.5.21.6.01.7.01.8.01.8.11.8.21.8.310.0.010.0.0.0rc111.0.011.0.0.0rc112.0.012.0.0.0rc112.0.0.0rc213.0.014.0.015.0.02.0.02.1.02.2.02.3.03.0.03.1.03.2.03.3.04.0.04.1.04.2.04.3.04.3.14.3.25.0.05.0.15.0.26.0.06.0.17.0.07.1.07.2.07.3.0
12.0.113.0.114.0.115.0.1
vitrage
Ubuntu:20.04:LTS
All versions, plus listed versions
4.3.1-36.0.0-0ubuntu16.0.1-0ubuntu1
None known
vitrage
Ubuntu:22.04:LTS
All versions, plus listed versions
7.5.0-0ubuntu17.5.0+git2021120910.95b33dbf-0ubuntu17.5.0+git2022011309.43091cd4-0ubuntu17.5.0+git2022011309.43091cd4-0ubuntu28.0.1-0ubuntu1
None known
vitrage
Ubuntu:24.04:LTS
All versions, plus listed versions
11.0.0-0ubuntu112.0.0~rc2-0ubuntu112.0.0-0ubuntu1
None known
vitrage
Ubuntu:25.10
All versions, plus listed versions
14.0.0-0ubuntu114.0.0+git2025070714.aafc997e-0ubuntu115.0.0-0ubuntu1
None known
vitrage
Ubuntu:26.10
All versions, plus listed versions
15.0.0+git20250930.3.5b57e2b3-0ubuntu1
None known
vitrage
Ubuntu:26.04:LTS
All versions, plus listed versions
15.0.0-0ubuntu115.0.0+git20250930.3.5b57e2b3-0ubuntu1
None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-28370 is a critical vulnerability (CVSS 9.1) in Openstack Vitrage, published February 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in vitrage 15.0.1.

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 7 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open