CVE-2026-28370: OpenStack Vitrage Unauthorized Access Leading to Eval Injection
Summary
CVE-2026-28370: OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection. Affects vitrage across 4 version ranges.
< 12.0.1
>= 13.0.0.0rc1, < 13.0.1
>= 14.0.0.0rc1, < 14.0.1
>= 15.0.0.0rc1, < 15.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenStack Vitrage is a service that provides a framework for monitoring and managing the health of cloud environments. It allows users to visualize and analyze the state of their cloud infrastructure, enabling proactive management and troubleshooting. However, certain versions of Vitrage are vulnerable to unauthorized access, which can lead to severe security issues.
Vulnerability Detail
The vulnerability exists in the query parser of OpenStack Vitrage prior to versions 12.0.1, 13.0.1, 14.0.1, and 15.0.1. A user with access to the Vitrage API can exploit this vulnerability to execute arbitrary code on the Vitrage service host. This unauthorized access can lead to a complete compromise of the Vitrage service, as it allows attackers to run code as the user under which the Vitrage service operates. The issue is rooted in the _create_query_function located in vitrage/graph/query.py.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.0.112.0.1pip install --upgrade "vitrage==12.0.1" -
>= 13.0.0.0rc1, < 13.0.113.0.1pip install --upgrade "vitrage==13.0.1" -
>= 14.0.0.0rc1, < 14.0.114.0.1pip install --upgrade "vitrage==14.0.1" -
>= 15.0.0.0rc1, < 15.0.115.0.1pip install --upgrade "vitrage==15.0.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, it is recommended to restrict access to the Vitrage API to trusted users only. Implementing network-level controls or using API gateways can help mitigate the risk until the package is updated.
Conclusion
The CVE-2026-28370 vulnerability in OpenStack Vitrage poses a significant risk due to the potential for unauthorized access and code execution. It is crucial for users to upgrade to the latest patched versions to safeguard their systems. Additionally, implementing temporary workarounds can help mitigate risks until the upgrade is completed.
See every vulnerability recorded for vitrage →
FAQ
CVE-2026-28370 is a critical vulnerability in OpenStack Vitrage that allows unauthorized access to the host, potentially leading to code execution.
Versions of Vitrage prior to 12.0.1, 13.0.1, 14.0.1, and 15.0.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
If immediate upgrading is not possible, restrict access to the Vitrage API and implement network-level controls to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for vitrage.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
