CVE-2026-28370

The vulnerability classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code) occurs in the _create_query_function function in the vitrage/graph/query.py file. The API query parser does not perform proper validation or sanitization of user-supplied input data, allowing injection and execution of arbitrary code on the server side. Exploitation is possible over the network without user interaction, but requires having permissions to use Vitrage API (PR:H).

An attacker can execute arbitrary code on the host running the Vitrage service with the privileges of the service account, which may lead to further compromise of the OpenStack infrastructure. Unauthorized access to the host and violation of system confidentiality, integrity, and availability are possible.

OpenStack Vitrage should be updated to version 12.0.1 or newer (respectively 13.0.0, 14.0.0, 15.0.0 for individual branches). Additionally, access to Vitrage API should be restricted to trusted, authorized users only, and network isolation of the service should be considered.

OpenStack Vitrage in all versions before 12.0.1, 13.0.0, 14.0.0, and 15.0.0. All deployments exposing Vitrage API are at risk.