OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardenin…

Medium CVSS 6.0

CVECVE-2026-55748

First seen2026-09-22 16:16 UTC

Disclosed2026-06-17 15:17 UTC

Last updated2026-09-22 16:16 UTC

Channel statusauto

Summary

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://launchpad.net/bugs/2152240 Issue Tracking
https://wiki.openstack.org/wiki/OSSN/OSSN-0097 Patch

Timeline

2026-09-22 nvd_ingest NVD