MEDIUM6.5
PYSEC-2026-1849
OpenStack's Mistral Client has a local file inclusion vulnerability
Quick fix
PYSEC-2026-1849 — python-mistralclient: upgrade to the fixed version with the command below.
pip install --upgrade 'python-mistralclient>=4.3.0'Details
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/python-mistralclient
Introduced in:
0Fixed in: 4.3.0Fix
pip install --upgrade 'python-mistralclient>=4.3.0'References
- https://nvd.nist.gov/vuln/detail/CVE-2021-4472[ADVISORY]
- https://access.redhat.com/security/cve/CVE-2021-4472[WEB]
- https://bugs.launchpad.net/horizon/+bug/1931558[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2417321[WEB]
- https://lists.debian.org/debian-lts-announce/2025/12/msg00002.html[WEB]
- https://lists.debian.org/debian-lts-announce/2025/12/msg00003.html[WEB]
- https://opendev.org/openstack/mistral-dashboard[PACKAGE]
- https://review.opendev.org/c/openstack/mistral-dashboard/+/800952[WEB]
- https://review.opendev.org/c/openstack/python-mistralclient/+/800950[WEB]
- https://pypi.org/project/python-mistralclient[PACKAGE]
- https://github.com/advisories/GHSA-75hx-6r6j-hw56[ADVISORY]