CVE-2026-28370CRITICAL 9.1EPSS p50.6%

CVE-2026-28370CVE-2026-28370

Description

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.

Scoring

CVSS 3.19.1 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS0.76% probability of exploitation · percentile 50.6% · 2026-06-19T12:03:05Z
Published2026-02-27
Last modified2026-03-05

Underlying weaknesses· 1

CWE-95

References

  1. https://github.com/openstack/vitrage/blob/a1f86950e1314b0c740f9cd9b7e9dbab7d02af51/vitrage/graph/query.py#L70
  2. https://storyboard.openstack.org/#%21/story/2011539
  3. http://www.openwall.com/lists/oss-security/2026/03/03/6

1

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')cwe-950%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-41283
CVE
CVE-2026-50589
CVE
CVE-2026-22207
CVE
CVE-2026-30402
CVE
CVE-2025-46412
CVE
CVE-2025-66944
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.