OpenStack Horizon
CVE-2026-55748
MEDIUM
Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
PR:H because project creation requires elevated admin rights; AC:H for the multi-step chain requiring crafted name plus victim execution; UI:R mandatory for victim to source the file.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
1DescriptionCVE.org
OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.
AnalysisAI
OpenStack Horizon before 25.7.4 embeds project names unsanitized into generated OpenStack RC shell scripts, enabling OS command injection when a victim user downloads and sources that script locally. An attacker with sufficient privileges to create or control a project name can insert shell metacharacters (e.g., backtick sequences, command substitution syntax) that execute arbitrary commands in the victim's local shell environment upon RC file execution. No public exploit code or CISA KEV listing exists at time of analysis, though the underlying CWE-78 class is well-understood; notably, the OpenStack project itself characterizes this as a security hardening opportunity rather than a traditional vulnerability, reflecting a disputed severity framing.
Technical ContextAI
OpenStack Horizon is the official web-based dashboard for managing OpenStack cloud infrastructure, identified by CPE cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*. A key Horizon feature allows users to download OpenStack RC files - shell scripts that set environment variables (OS_PROJECT_NAME, OS_AUTH_URL, credentials, etc.) for use with the OpenStack CLI. These RC files are intended to be sourced in a user's shell (e.g., 'source openrc.sh'). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command, i.e., OS Command Injection): Horizon fails to sanitize or quote project names before embedding them into the generated shell script. Shell metacharacters such as backticks (...), command substitution ($(...)), semicolons, or newlines in a project name thus become executable shell code when the RC file is processed by a POSIX shell.
RemediationAI
The primary remediation is to upgrade OpenStack Horizon to version 25.7.4 or later, which addresses the unsanitized embedding of project names in RC script generation. Refer to https://wiki.openstack.org/wiki/OSSN/OSSN-0097 for the official advisory. As a compensating control where immediate upgrade is not feasible, administrators should enforce project naming policies that prohibit shell metacharacters (backticks, dollar signs followed by parentheses, semicolons, newlines) through input validation at the project creation layer or via OpenStack policy rules. Trade-off: naming restrictions may inconvenience tenants with existing nonstandard project names and may require renaming projects before RC file use. Additionally, operators can instruct users to inspect downloaded RC files before sourcing them and to treat them as untrusted shell scripts - a defense that reduces but does not eliminate risk since most users will not audit these files routinely.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today