« Volver al listado

CVE-2026-28370

Estado: ModificadaCrítica (9.1)—

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS con AV:N/AC:L/PR:H/UI:N permite explotación remota de servicio (T1210); CWE-95 (code injection) y descripción explícita de 'code execution' fundamentan T1059; acceso posterior al host e escalada bajo el contexto del servicio justifican T1068 secundario.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

Openstack — Vitrage

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-28370",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28370",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-27T15:47:42.815443Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "OpenStack",
          "product": "Vitrage",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "12.0.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "15.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-02-27T05:18:20.757",
  "references": [
    {
      "url": "https://github.com/openstack/vitrage/blob/a1f86950e1314b0c740f9cd9b7e9dbab7d02af51/vitrage/graph/query.py#L70",
      "tags": [
        "Issue Tracking"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://storyboard.openstack.org/#%21/story/2011539",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/03/03/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-95"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py."
    },
    {
      "lang": "es",
      "value": "En el analizador de consultas de OpenStack Vitrage antes de las versiones 12.0.1, 13.0.0, 14.0.0 y 15.0.0, un usuario con permiso para acceder a la API de Vitrage podría desencadenar la ejecución de código en el host del servicio Vitrage como el usuario bajo el cual se ejecuta el servicio Vitrage. Esto podría resultar en acceso no autorizado al host y un compromiso adicional del servicio Vitrage. Todas las implementaciones que exponen la API de Vitrage se ven afectadas. Esto ocurre en _create_query_function en vitrage/graph/query.py."
    }
  ],
  "lastModified": "2026-06-17T10:28:29.943",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openstack:vitrage:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "819FA93C-959C-4AF7-B901-F84A7300387E",
              "versionEndExcluding": "12.01"
            },
            {
              "criteria": "cpe:2.3:a:openstack:vitrage:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08776A5E-89BE-4C75-A80D-144381B2B783",
              "versionEndExcluding": "13.0.1",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:openstack:vitrage:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "085F48A1-4497-48BD-87DC-662CFF9D209F",
              "versionEndExcluding": "14.0.1",
              "versionStartIncluding": "14.0.0"
            },
            {
              "criteria": "cpe:2.3:a:openstack:vitrage:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FBEE245-024B-4950-B5CD-9B0B9AB40847",
              "versionEndExcluding": "15.0.1",
              "versionStartIncluding": "15.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}