OpenStack Mistral through version 22.0.0 contains an authorization bypass vulnerability (CWE-863) that allows remote attackers with network access and limited privileges to execute arbitrary code via exposed API endpoints. This flaw can lead to a complete compromise of the service, including exfiltration of sensitive credentials. The CVSS 3.1 base score is 9.9, reflecting critical impact with network attack vector, low attack complexity, no user interaction, and high confidentiality, integrity, and availability impacts. No official patch or remediation level is currently provided by the vendor. The Red Hat advisory linked does not explicitly state a fix or mitigation status.

Successful exploitation results in arbitrary remote code execution on the OpenStack Mistral service, potentially allowing attackers to exfiltrate service credentials and fully compromise the affected system. The vulnerability affects confidentiality, integrity, and availability of the service, making it critical for environments exposing the Mistral API.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is stated in the vendor advisory, users should restrict network access to the Mistral API to trusted entities only and monitor for unusual activity. Follow updates from OpenStack and Red Hat for forthcoming patches or official mitigations.