A critical arbitrary file access vulnerability in Mistral Vibe allows unauthenticated attackers to bypass workspace restrictions and access unauthorized files, posing a severe risk to data confidentiality.

This vulnerability is classified as an incorrect permission assignment for critical resources (CWE-732), where commands deemed unconditionally allowed lack necessary path validation. An unauthenticated attacker can exploit this to traverse outside the intended workspace environment.

The ability for an unauthenticated attacker to access arbitrary files on the host system constitutes a total compromise of confidentiality and integrity. Given the CVSS score of 10.0, this flaw could lead to the exposure of sensitive configuration files, credentials, or proprietary data, resulting in significant regulatory and reputational damage.

Immediate Action: As a patch is currently not confirmed, organizations should restrict network access to the Mistral Vibe instance to trusted internal segments only. Monitor official vendor channels for the release of a security update and apply it immediately upon availability.

Proactive Monitoring: Review system access logs for anomalous file path requests or unauthorized read attempts originating from the application process.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict path validation rules to block requests containing directory traversal characters or patterns indicative of workspace breakout attempts.

Public Exploit Available: No (exploit_available: false)

Due to the critical nature of this vulnerability and the potential for full system compromise, immediate containment is required. If the application is internet-facing, it should be moved behind a secure gateway or taken offline until a vendor-provided patch is applied. Prioritize the monitoring of file system logs to detect any signs of unauthorized access until remediation is complete.