OpenStack Horizon EUVD-2026-27406

No authentication is required - the vulnerability exists in the pre-authentication code path. Any network-accessible Horizon instance without rate limiting is vulnerable. The attack succeeds against default configurations; no special deployment modes or feature flags need to be enabled. The limiting factor is network bandwidth and the attacker's ability to sustain rapid HTTP requests; the application's session backend must accept write operations from unauthenticated sources (the bug itself).

CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and EPSS data are not provided, but the vector indicates moderate risk: network-accessible, low complexity, no authentication barrier, and unauthenticated exploitation capability. The primary impact is availability (denial of service), not confidentiality or integrity. No KEV status or public POC is indicated in the input data. Real-world risk is moderate: the attack is simple to execute (requires only HTTP client capable of rapid requests) and requires no special skills, but is limited to denial-of-service impact without lateral movement potential. Organizations running Horizon 25.6 or 25.7.0-25.7.2 in production should prioritize patching; non-production instances are lower priority.

An attacker writes a simple Python or curl loop that sends GET requests to the Horizon login page (or any unauthenticated endpoint) from a single machine or distributed botnet. Each request creates a session entry in the backend storage. Within minutes to hours depending on storage capacity and attack rate, the session store fills to capacity, causing new legitimate user sessions to fail and rendering the Horizon dashboard unavailable.