PatchSiren cyber security CVE debrief
CVE-2026-55748 OpenStack CVE debrief
OpenStack Horizon versions before 25.7.4 are vulnerable to a script injection issue. The vulnerability arises from the production of scripts for OpenStack RC file downloading that may contain crafted project names with shell metacharacters. This issue is considered a security hardening opportunity to address certain types of user error, rather than a traditional vulnerability. The CVSS score for this vulnerability is 6, indicating a medium severity level. Users of OpenStack Horizon should take precautions to ensure their project names do not contain malicious characters.
- Vendor
- OpenStack
- Product
- Horizon
- CVSS
- MEDIUM 6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-17
- Original CVE updated
- 2026-06-17
- Advisory published
- 2026-06-17
- Advisory updated
- 2026-06-17
Who should care
Administrators and users of OpenStack Horizon, particularly those who allow users to create projects with custom names, should be aware of this vulnerability. This issue may allow users to inject malicious scripts into the OpenStack RC file downloading process.
Technical summary
The vulnerability exists in the script generation for OpenStack RC file downloading in OpenStack Horizon. The scripts are generated with project names that may contain shell metacharacters, allowing for potential script injection. The Common Vulnerability Scoring System (CVSS) vector for this vulnerability is CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L. The weakness associated with this vulnerability is CWE-78.
Defensive priority
Medium
Recommended defensive actions
- Update OpenStack Horizon to version 25.7.4 or later
- Validate and sanitize project names to prevent shell metacharacters
- Implement proper input validation and output encoding
- Monitor OpenStack Horizon logs for suspicious activity
- Restrict project name characters to alphanumeric and underscore
- Use a Web Application Firewall (WAF) to detect and prevent attacks
- Educate users on secure project naming practices
Evidence notes
The information provided is based on data from the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The CVE record and NVD detail pages provide further information on this vulnerability.
Official resources
CVE-2026-55748 was published on 2026-06-17T15:17:02.503Z and modified on 2026-06-17T17:17:27.727Z.