Code Execution Vulnerability in OpenStack Vitrage API
CVE-2026-28370

9.1CRITICAL

Key Information:

Vendor

Openstack
Status
Vitrage
Vendor
CVE Published:
27 February 2026

What is CVE-2026-28370?

A vulnerability in the query parser of OpenStack Vitrage allows a user with access to the Vitrage API to execute code on the service host, potentially leading to unauthorized access and compromise of the Vitrage service. This vulnerability is present in versions prior to 12.0.1, 13.0.0, 14.0.0, and 15.0.0. The exploit occurs within the _create_query_function in the vitrage/graph/query.py file, affecting all deployments that expose the Vitrage API.

Affected Version(s)

Vitrage 0 < 12.0.1

Vitrage 13.0.0

Vitrage 14.0.0

References

https://storyboard.openstack.org/#%21/story/2011539
https://github.com/openstack/vitrage/blob/a1f86950e1314b0...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.