CVE-2026-55748: OpenStack Horizon RC File Command Injection Vulnerability

Technical summary

CVE-2026-55748 is a command injection vulnerability (CWE-78) in OpenStack Horizon versions prior to 25.7.4. The vulnerability exists in the RC file generation functionality, which outputs shell script content for credential setup. When a project name contains shell metacharacters, these are not properly escaped or sanitized before being embedded into the generated script. An authenticated user or administrator who downloads an RC file and sources it in a shell environment could inadvertently execute arbitrary commands if the project name has been crafted with special characters. The CVSS 3.1 score of 6.0 (MEDIUM) reflects the requirement for high privilege (PR:H), human interaction (UI:R), and network accessibility.

Business impact

For organizations running OpenStack, this vulnerability primarily affects administrator and power-user workflows. The impact is contingent on an attacker's ability to create or modify a project name—typically a high-privilege operation—and on a user consciously sourcing an RC file in their shell. In environments with federated or multi-tenant OpenStack deployments, a rogue project name could compromise credential handling and cloud resource access. The requirement for user interaction (sourcing the script) and high privilege (creating the malicious project) limits opportunistic exploitation, but the vulnerability may still pose risk in less mature operational environments or where access controls are loose.

Affected systems

OpenStack Horizon versions before 25.7.4 are affected. This includes all recent versions of OpenStack Horizon deployed in on-premises or private cloud environments. No specific version range beyond '25.7.4 and later' is provided in the advisory; organizations should verify their deployed Horizon version and reference the upstream OpenStack security advisory for complete version mapping. Vendors and resellers bundling Horizon with their own distributions should be consulted.

Exploitability

Exploitation requires several preconditions: (1) authenticated access to OpenStack Horizon with project creation or modification privileges; (2) the ability to inject shell metacharacters into a project name; (3) a user or administrator who downloads the RC file; and (4) that user sourcing the RC file in a shell environment. The CVSS vector (AV:N/AC:H/PR:H/UI:R) reflects these constraints—particularly the high complexity (AC:H) and human interaction requirement. This is not a trivial or widespread risk; it is a targeted vector requiring insider access or compromise of an account with elevated permissions. The vulnerability is not listed on the CISA KEV catalog, indicating no known active exploitation in the wild.

Remediation

Upgrade OpenStack Horizon to version 25.7.4 or later. This patched version properly escapes or sanitizes shell metacharacters before embedding them into RC file generation output. Organizations should coordinate patching with their OpenStack release cycle and test RC file generation in a staging environment. If immediate patching is not feasible, consider restricting project creation and naming conventions via administrative policy, or educating users to review RC files before sourcing them.

Patch guidance

Verify your deployed OpenStack Horizon version by checking the Horizon service logs or the web dashboard footer (if available). Version 25.7.4 and later contain the fix. Consult your OpenStack distribution vendor's advisory for exact patch availability and release timing. Test the patched version's RC file generation with a test project name containing shell metacharacters (e.g., a project name with a backtick or dollar sign) to confirm the characters are properly escaped in the downloaded script. Rolling updates should be coordinated with your cloud operations team to avoid service disruption.

Detection guidance

Monitor OpenStack Horizon logs for RC file download events, particularly those associated with project names containing unusual characters or patterns. Audit project creation and modification events to identify any names with shell metacharacters. Review shell command histories on administrator and user systems for evidence of unexpected command execution following RC file sourcing. In mature environments, SIEM correlation can flag RC downloads followed by unusual system commands. Additionally, code review of any custom Horizon extensions or plugins that may generate shell scripts should be performed to ensure they do not introduce similar vulnerabilities.

Why prioritize this

While the CVSS score is MEDIUM (6.0), the practical risk is somewhat lower due to the high barriers to exploitation—namely high privilege requirement, human interaction, and limited active threat landscape (no KEV listing). However, in cloud environments where operational discipline is critical, any command injection risk affecting credential files warrants prompt attention. Prioritize this for organizations with looser project naming controls, federated multi-tenant environments, or where user training on RC file safety is minimal. Organizations with mature access controls and small, trusted administrator bases may defer patching slightly, but should not ignore it indefinitely.

Risk score, explained

The CVSS 3.1 score of 6.0 (MEDIUM) is driven by: (1) Network-accessible attack vector (AV:N); (2) High attack complexity due to the need for privilege, user interaction, and shell sourcing (AC:H); (3) High privilege requirement to create or modify project names (PR:H); (4) User interaction required—the victim must download and source the RC file (UI:R); (5) High impact on confidentiality and integrity should exploitation succeed (C:H/I:H), but only low impact on availability (A:L). The lack of CVSS temporal factors (no active exploitation, no proof-of-concept publicly available) and the requirement for an insider or highly privileged attacker explain why this does not reach a CRITICAL or HIGH rating despite the command injection potential.

Frequently asked questions