CVE-2026-87983 mistralai CVE debrief

Who should care

Defenders and administrators of Mistral Vibe installations, particularly those using version 2.6.0 or later, should assess exposure and prioritize patching. This critical vulnerability enables unauthorized data access and potential exploitation of sensitive information. Security teams and vulnerability management teams should review the CVE record and NVD entry to understand the vulnerability and implement additional security measures.

Why it matters

CVE-2026-87983 is a critical vulnerability in Mistral Vibe that allows arbitrary file read, potentially leading to unauthorized data access and exploitation of sensitive information. Defenders and administrators should assess exposure, prioritize patching, and implement additional security measures.

• Potential unauthorized data access
• Bypassing of workspace restrictions
• Possible exploitation of sensitive information
• Verification of patching and configuration

Technical summary

The CVE record and NVD entry describe a critical vulnerability in Mistral Vibe, introduced in version 2.6.0, allowing an attacker to bypass workspace restrictions and read files outside the active workspace. This vulnerability is caused by improper handling of quotation marks during path validation, enabling files outside the active workspace to be read without user approval. The vulnerability has a CVSS score of 9.2 and is classified as CRITICAL. Defenders and administrators should assess exposure and prioritize patching to mitigate potential risks.

Defensive priority

High

Recommended defensive actions

• Review and update Mistral Vibe installations to ensure version 2.6.0 or later is patched
• Restrict access to sensitive files and directories
• Monitor for suspicious activity and implement additional security measures
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry describe a critical vulnerability in Mistral Vibe, introduced in version 2.6.0, allowing an attacker to bypass workspace restrictions and read files outside the active workspace. The vulnerability is caused by improper handling of quotation marks during path validation. The CVE Program and NVD provide official details on the vulnerability, including its CVSS score and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.