CVE-2026-55748
Description
OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.
Summary dbcve.org
OpenStack Horizon before version 25.7.4 generates shell scripts for downloading OpenStack RC files that may contain unsanitized project names. If a project name includes shell metacharacters (such as ;, |, $, or backticks), these could be interpreted as shell commands when the generated script is executed, potentially leading to command injection.
Mitigation
Upgrade OpenStack Horizon to version 25.7.4 or later, which properly sanitizes project names before embedding them in generated RC file download scripts.