openstack/horizon · Security
OpenStack Horizon RC file generation does not escape special characters in project names
- GHSA ID
- GHSA-6wrm-x65g-hr4p
- CVE ID
- CVE-2026-55748
- Severity
- medium
- Published
- Updated
- CVSS
- 6 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
- CVSS v3
- 6 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
Description
OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.
CWEs
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')