CVE-2026-55748 Details
Description
OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.
A vulnerability exists in OpenStack Horizon versions 25.4.0 prior to 25.5.3, 25.6.0 prior to 25.7.4, and all versions through 25.3.3. The issue arises because Horizon generates OpenStack RC files with user-supplied project names that can include shell metacharacters. This flaw allows for the injection of arbitrary commands, which are executed in the user's shell when the RC file is sourced. The vulnerability can be exploited by creating a project with a crafted name that includes command substitution syntax, such as dollar signs followed by parentheses or backticks. Once the project is created, the injected commands will execute in the context of the user who sources the RC file.
Users can upgrade to OpenStack Horizon versions 25.7.4 or later. If an immediate upgrade is not possible, inspect RC files for untrusted project names before sourcing them, or use the 'clouds.yaml' file for authentication with the OpenStack CLI.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://launchpad.net/bugs/2152240 | [email protected] | Issue TrackingVendor Advisory |
| https://wiki.openstack.org/wiki/OSSN/OSSN-0097 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openstack horizon | >= 8.0.0, < 25.3.3 >= 25.4.0, < 25.5.3 >= 25.6.0, < 25.7.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |