CVE-2026-28370 — AI Deep Analysis Summary

🚨 **Essence**: OpenStack Vitrage has a critical flaw in its **Query Parser**. <br>💥 **Consequences**: Attackers can achieve **Remote Code Execution (RCE)**.…

🛡️ **Root Cause**: **CWE-95** (Improper Neutralization of Special Elements in Code). <br>🔍 **Flaw**: The query parser fails to properly sanitize input, allowing malicious code injection.

📦 **Affected**: OpenStack Vitrage. <br>📉 **Versions**: <br>- < 12.0.1 <br>- < 13.0.0 <br>- < 14.0.0 <br>- < 15.0.0

💀 **Attacker Capabilities**: Full **Code Execution**. <br>🔓 **Privileges**: Can likely escalate to system-level access. <br>📊 **Impact**: Total compromise of the Vitrage engine and potentially the underlying host.

🔐 **Threshold**: **Medium**. <br>⚠️ **Auth Required**: Yes, **PR:H** (High Privileges) needed. <br>🌐 **Access**: Network accessible (**AV:N**). <br>👤 **User Interaction**: None (**UI:N**).

🕵️ **Public Exploit**: **No**. <br>📂 **PoC**: Empty in data. <br>🌍 **Wild Exploitation**: Unconfirmed. However, the flaw is in a core parser, making it highly attractive.

🔍 **Self-Check**: Scan for OpenStack Vitrage services. <br>📋 **Verify Version**: Ensure version is **12.0.1+**, **13.0.0+**, **14.0.0+**, or **15.0.0+**.…

✅ **Fixed**: **Yes**. <br>📅 **Published**: 2026-02-27. <br>🔧 **Mitigation**: Upgrade to the fixed versions listed in Q3. Reference: [OpenStack Storyboard](https://storyboard.openstack.org/#/story/2011539).

🚧 **No Patch Workaround**: <br>1. **Restrict Access**: Limit network access to Vitrage API. <br>2. **Input Validation**: Implement strict sanitization on query inputs. <br>3.…

🔥 **Urgency**: **HIGH**. <br>⚡ **Priority**: Patch immediately. <br>📉 **Risk**: CVSS Vector indicates **Critical** impact (C:H, I:H, A:H). Do not ignore.