OpenStack Mistral through version 22.0.0 contains a critical vulnerability that allows arbitrary remote code execution when the API is exposed. The vulnerability exists in certain endpoints that permit code execution, potentially leading to the exfiltration of service credentials. This affects all versions up to and including 22.0.0 of the OpenStack Mistral workflow service. The vulnerability has been assigned CVE-2026-41283 and poses a significant security risk to OpenStack deployments with exposed Mistral APIs.