Current Series Release Notes¶

23.0.0-29¶

The std.ssh_proxied action now refuses any proxy_command that is not listed in the new [action_std_ssh] allowed_proxy_commands config option (empty by default). If you use proxy_command, add its exact value to this option.

Fixed a cross-project isolation flaw when updating workbooks and environments. A regular (non-admin) project member could modify â€” and unpublish â€” a public workbook or environment belonging to another project, because the update looked the object up with a query that includes other projects’ public resources and performed no ownership check before writing. Updates now resolve the object within the caller’s own project and enforce check_db_obj_access(), consistently with workflow and action definitions.

The cluster maintenance endpoint is now guarded by policy. Reading the status (GET /maintenance) requires the new maintenance:get rule and changing it (PUT /maintenance) requires the new maintenance:update rule; both default to admin only (rule:admin_only). Previously the endpoint enforced no policy, so any authenticated token holder could read the status or switch the cluster to PAUSED - a cluster-wide operation that pauses running executions across all projects. Operators who need to grant these to non-admins can override the rules in policy.yaml.

Fixed a resource-sharing privilege escalation. Only the owner of a workflow may now share it (create a membership for it). Previously the share endpoint (POST /v2/workflows/<id>/members) only checked that the caller could see the workflow and that it was private. A project that had a workflow shared with it and accepted the share can read the definition through the shared-resource query, and could therefore re-share the owner’s private workflow with a third project without the owner’s consent. The derived membership was owned by the re-sharing project, so the real owner could neither see nor revoke it, while the third project could accept it and read and execute the owner’s private workflow. The share operation is now rejected with 403 unless the caller is the resource owner.

Fixed a remote code execution vulnerability in the std.ssh_proxied action. The action passed a caller-supplied proxy_command straight to paramiko.ProxyCommand, which runs it as a local subprocess on the executor host - before any SSH authentication and regardless of the SSH credentials or gateway supplied. Any authenticated, project-scoped user could therefore run arbitrary commands on every Mistral executor by submitting the action through the standard action-execution API.

proxy_command is now rejected unless its exact value appears in the new [action_std_ssh] allowed_proxy_commands allow-list, which is empty by default. Existing deployments that rely on a proxy_command must add the exact command string to this option; otherwise the action fails with a clear error instead of executing it.

The event engine now listens for notifications on the transport set by [oslo_messaging_notifications] transport_url. It used to listen on the RPC transport from [DEFAULT] transport_url, so event triggers never fired when notifications were sent to a separate bus. When [oslo_messaging_notifications] transport_url is not set, the [DEFAULT] one is still used.

create_or_update_cron_trigger now resolves the existing trigger within the caller’s own project, so that when several projects have a cron trigger with the same name the caller’s own one is updated instead of another project’s (possibly public) trigger. The periodic scheduler’s update_cron_trigger bookkeeping is intentionally left unchanged, as it legitimately updates triggers across projects; the cron trigger REST API exposes no update operation.

Creating or updating a workflow or ad-hoc action definition (including implicitly through a workbook) no longer touches a definition of another project that happens to have the same name. Previously, when several projects had a definition with the same name, an admin request could pick an arbitrary one of them, move it into the admin’s project and fail with an unhandled duplicate entry error (HTTP 500). The existing definition to update is now looked up by its full unique key (name, namespace and project id).

Updating an ad-hoc action definition now verifies that the caller is allowed to modify it, consistently with workflow definitions: a non-admin request can no longer modify a public action definition of another project, and system action definitions are protected from modification by non-admin users at the database layer. In addition, when several projects have an action definition with the same name, an update now always targets the definition of the caller’s project instead of an arbitrary one.

Updating a code source or a dynamic action definition no longer risks modifying an object of another project that happens to have the same name. The existing object is now resolved within the caller’s own project (by name, namespace and project id) before writing, and an ownership check is applied, consistently with the other definition types. These resources are admin-only by default policy, so this is a hardening / data-integrity fix rather than a cross-tenant escalation.

update_workbook now verifies ownership before writing. Previously it was only protected indirectly (a workbook update cascades into the workflow-definition update, which was guarded); making the workflow lookup project-scoped removed that incidental protection, so the guard is now applied to the workbook itself.

Trust lookups and deletions now use the keystone configured in [keystone_authtoken] auth_url, the same one trusts are created in, instead of the first identity endpoint of the service catalog. This fixes “Could not find trust” errors and leaked trusts in deployments with one keystone per region. See LP#1862940.