MEDIUM

CVE-2026-55748

2026-06-17 CVSS v3.1
CVSS
6

Description

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.

Summary dbcve.org

OpenStack Horizon before version 25.7.4 generates shell scripts for downloading OpenStack RC files that may contain unsanitized project names. If a project name includes shell metacharacters (such as ;, |, $, or backticks), these could be interpreted as shell commands when the generated script is executed, potentially leading to command injection.

Mitigation

Upgrade OpenStack Horizon to version 25.7.4 or later, which properly sanitizes project names before embedding them in generated RC file download scripts.

Weakness (CWE)

CWE-78 OS Command Injection

EPSS Score

0.22%
Probability of exploitation in next 30 days
12.6th percentile

References

View on dbcve.org
Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.
Back to CVE