CVE-2026-55748

MediumCVSS 6.0

Published: 17/06/2026(UTC)Updated: 22/09/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

OpenStack Horizon before version 25.7.4 produces scripts for downloading OpenStack RC files that may contain a crafted project name with shell metacharacters.

Risk Assessment

There is a risk that improper use of shell metacharacters could lead to unintended actions in the system, potentially affecting application security.

Recommendation

It is recommended to upgrade to version 25.7.4 or later to mitigate the risks associated with this issue.

Other vulnerabilities in OpenStack Horizon

CVE-2026-43002Medium
In OpenStack Horizon versions 25.6 and 25.7 before 25.7.3, a write operation to the session storage backend occurs before authentication, allowing unauthenticated requests to exhaust storage. This is a regression of the CVE-2014-8124 fix.

Original NVD description (English source)

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS