Information disclosure in [UNKNOWN] openstack-mistral
Priority LOW 36CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 fixed, 2 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.
Why it matters now
EPSS 0.0152 74th percentileScored 2026-11-07
Fix Partial mistral (PyPI): 7.0.1Red Hat: 1 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| [UNKNOWN] | openstack-mistral | all versions | — | No fix listed | CNA |
| — | mistral (PyPI) | before 7.0.1 | 7.0.1 | Patch available | GHSA-fqw7-c6vr-q29m |
- openstack-mistral Vendor[UNKNOWN] Affected all versions Fixed in — No fix listed CNA
- mistral (PyPI) Vendor— Affected before 7.0.1 Fixed in 7.0.1 Patch available GHSA-fqw7-c6vr-q29m
Remediation
- Fix · GHSA-fqw7-c6vr-q29m mistral (PyPI) Fixed in 7.0.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 15 (Stein) | Affected | No fix yet |
| Red Hat OpenStack Platform 13.0 | Fixed | — |
Timeline
- 2026-10-02 Threatist record created from CVE-2018-16849
- 2026-10-03 Alias added: GHSA-fqw7-c6vr-q29m
References
Advisory 3
More Red Hat Openstack-mistral vulnerabilities
- TI-2018-12058 Uncontrolled resource consumption in openstack-mistral CVSS 3.1MEDIUM 6.5
- TI-2019-02876 Incorrect permission assignment in [UNKNOWN] openstack-mistral CVSS 3.1MEDIUM 5.5
Sources
- CVE-2018-16849 · CVE Program
- CVE-2018-16849 · NVD
- FIRST EPSS
- GHSA-fqw7-c6vr-q29m · GitHub Advisory Database · CC BY 4.0
- CVE-2018-16849 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences