PYSEC-2026-2519

vendorUSosv

OpenStack Horizon RC file generation does not escape special characters in project names

view advisory published 2026-07-13Licence: CC-BY-4.0

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-55748US	medium6.8	0.25% (17th)	—	2026-06-17
OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-6wrm-x65g-hr4pADVISORY
https://github.com/openstack/horizonPACKAGE
https://launchpad.net/bugs/2152240WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-55748ADVISORY
https://pypi.org/project/horizonPACKAGE
https://wiki.openstack.org/wiki/OSSN/OSSN-0097WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan