CVE-2026-28370
2 advisories.
PyPI/vitrage CVE-2026-28370: critical 9.1, EPSS 0.84%
OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection
Action: Upgrade vitrage to 12.0.1 or later.
pip install vitrage==15.0.1pip install vitrage==14.0.1pip install vitrage==13.0.1pip install vitrage==12.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 15.0.0.0rc1 | 15.0.1 | - |
| 14.0.0.0rc1 | 14.0.1 | - |
| 13.0.0.0rc1 | 13.0.1 | - |
| 0 | 12.0.1 | - |
Fixed versions
| 15.0.1 | 14.0.1 | 13.0.1 | 12.0.1 |
Sources
- osv: GHSA-8xwf-cr4r-856r
- https://nvd.nist.gov/vuln/detail/CVE-2026-28370
- https://github.com/openstack/vitrage/commit/89df4bd2ffda1a5ddea66cd828438a6a171a3b11
- https://github.com/openstack/vitrage
- https://github.com/openstack/vitrage/blob/a1f86950e1314b0c740f9cd9b7e9dbab7d02af51/vitrage/graph/query.py#L70
- https://storyboard.openstack.org/#%21/story/2011539
- http://www.openwall.com/lists/oss-security/2026/03/03/6
CVE-2026-28370 · published · modified · JSON
PyPI/vitrage CVE-2026-28370: critical 9.1, EPSS 0.84%
OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection
Action: Upgrade vitrage to 12.0.1 or later.
pip install vitrage==12.0.1pip install vitrage==13.0.1pip install vitrage==14.0.1pip install vitrage==15.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 12.0.1 | - |
| 13.0.0.0rc1 | 13.0.1 | - |
| 14.0.0.0rc1 | 14.0.1 | - |
| 15.0.0.0rc1 | 15.0.1 | - |
Fixed versions
| 12.0.1 | 13.0.1 | 14.0.1 | 15.0.1 |
Sources
- osv: PYSEC-2026-564
- https://nvd.nist.gov/vuln/detail/CVE-2026-28370
- https://github.com/openstack/vitrage/commit/89df4bd2ffda1a5ddea66cd828438a6a171a3b11
- https://github.com/openstack/vitrage
- https://github.com/openstack/vitrage/blob/a1f86950e1314b0c740f9cd9b7e9dbab7d02af51/vitrage/graph/query.py#L70
- https://storyboard.openstack.org/#%21/story/2011539
- http://www.openwall.com/lists/oss-security/2026/03/03/6
- https://pypi.org/project/vitrage
- https://github.com/advisories/GHSA-8xwf-cr4r-856r
CVE-2026-28370 · published · modified · JSON