)]}'
{"id":"openstack%2Fmistral~1009482","triplet_id":"openstack%2Fmistral~stable%2F2026.2~Id749206e5581037721c23609770dc390cb5b4b59","project":"openstack/mistral","branch":"stable/2026.2","topic":"mistral-OSSA-2026-044","hashtags":[],"change_id":"Id749206e5581037721c23609770dc390cb5b4b59","subject":"Fix RCE via std.ssh_proxied proxy_command","status":"MERGED","created":"2026-10-08 14:12:08.000000000","updated":"2026-10-08 19:03:40.000000000","submitted":"2026-10-08 19:01:27.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1009482-mistral-OSSA-2026-044","meta_rev_id":"0cb7e62b706d2cc979ca474d0c6cde565132d1e0","_number":1009482,"virtual_id_number":1009482,"owner":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-10-08 19:01:27.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-10-08 17:42:45.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-10-08 17:42:45.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-10-08 15:32:51.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"5168f82ba552aa6c24259acaf4533cec0d60d163","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 14:12:08.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"fd55a36ce35136203d807dfc57021e10b0ad9ce3","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 15:32:51.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/1e67a57144eb4dac9b1012c7845140a7\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/cbc465118e214eaa84a91a963c1242b1 : SUCCESS in 3m 21s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/1801b65156414007b427f22a1cf70ce4 : SUCCESS in 11m 05s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/b81fd20d6d4047cdac901bd03bf249de : SUCCESS in 9m 54s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/019753c2968e4f4b8ff34395eb5e3872 : SUCCESS in 14m 15s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/51c656c7ff0f420d884c94a033ad5929 : SUCCESS in 6m 05s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/bb1a27c81159443ebc181dd7cb38a139 : SUCCESS in 4m 02s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/963ab77c54054cf987b6bd538ec75597 : SUCCESS in 13m 06s (non-voting)\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/e730090837214289a9752e9cc597d086 : SUCCESS in 28m 58s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/4fb484447f644b44976ce6ef165357ec : SUCCESS in 22m 47s","accounts_in_message":[],"_revision_number":1},{"id":"3c520adaf6149e922654a71c81b948c636bdf2a5","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 17:42:45.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"fa43333e181e190b695e802918e5cd658fe17b98","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 17:45:38.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"e9464de331b2e2e7a81910934ca50d25ec1ed4e7","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 19:01:27.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/dffe6a8e67664e5db7fede1b098d9ec5\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9d33fe9e3ba443e09932bc534f0c6a30 : SUCCESS in 4m 11s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/41b87d3b92d84a66b51f0274ec081c4d : SUCCESS in 10m 00s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/7317e8e09d6e462685a10511dcb60b12 : SUCCESS in 11m 35s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/2e4eb899613648b3847b2b265ca7645e : SUCCESS in 9m 13s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/416db722a70d40df93753aaef11b6206 : SUCCESS in 3m 08s\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/c91ea8ffd7b54b17aee6e77ee4dc3829 : SUCCESS in 45m 01s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/f72325c7e4154d03945ba8ff73adad2c : SUCCESS in 23m 42s","accounts_in_message":[],"_revision_number":1},{"id":"d4ec99288a4fbc90030a5b96f6b5612c28bfd21a","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 19:01:27.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"0cb7e62b706d2cc979ca474d0c6cde565132d1e0","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 19:03:40.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/fb1505d25d8b471895199dd182eb3ec2\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ed79f49d17664e2696ab557f1c3f7ec7 : SUCCESS in 42s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/76bfb89b8a5f4e0fa91d7ad5b6877dd0 : SUCCESS in 46s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"f550c5532833b937ea74bbc0c6809f1788895252","revisions":{"f550c5532833b937ea74bbc0c6809f1788895252":{"kind":"REWORK","_number":1,"created":"2026-10-08 14:12:08.000000000","uploader":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"ref":"refs/changes/82/1009482/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/mistral","ref":"refs/changes/82/1009482/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/mistral refs/changes/82/1009482/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/mistral refs/changes/82/1009482/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/mistral refs/changes/82/1009482/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/mistral refs/changes/82/1009482/1"}}},"commit":{"parents":[{"commit":"9c05876bd1a74f60a1a07ce06e7daf556e1fe49c","subject":"Only allow the owner of a resource to share it","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/9c05876bd1a74f60a1a07ce06e7daf556e1fe49c"}]}],"author":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-08-26 08:36:06.000000000","tz":120},"committer":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-10-08 14:11:11.000000000","tz":120},"subject":"Fix RCE via std.ssh_proxied proxy_command","message":"Fix RCE via std.ssh_proxied proxy_command\n\nThe std.ssh_proxied action passed a caller-supplied proxy_command\nstraight to paramiko.ProxyCommand in execute_command_via_gateway.\nparamiko.ProxyCommand runs the string as a local subprocess on the\nexecutor host from its constructor - before any SSH authentication and\nindependently of the SSH credentials, gateway or target supplied (a bad\nor empty key does not stop it). std.ssh_proxied is a built-in action, so\nany authenticated, project-scoped user could run arbitrary commands on\nevery Mistral executor by submitting it through the action-execution\nAPI. This is a remote code execution vulnerability.\n\nGate proxy_command behind a new \u0027[action_std_ssh] allowed_proxy_commands\u0027\nallow-list (empty by default). execute_command_via_gateway now rejects,\nwith an ActionException, any proxy_command whose exact value is not\nlisted, before paramiko is invoked - so by default proxy_command is\ndisabled and no local subprocess can be spawned. Operators who rely on\nit must add the exact command string to the option. The rejection reason\nreaches the caller thanks to the preceding change.\n\nCloses-Bug: #2162100\nSigned-off-by: Arnaud Morin \u003carnaud.morin@gmail.com\u003e\nChange-Id: Id749206e5581037721c23609770dc390cb5b4b59\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/f550c5532833b937ea74bbc0c6809f1788895252"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/f550c5532833b937ea74bbc0c6809f1788895252"}]},"branch":"refs/heads/stable/2026.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}