CVE-2026-55748: OpenStack Horizon RCE Vulnerability

CVE-2026-55748 Overview

CVE-2026-55748 affects OpenStack Horizon versions before 25.7.4. The dashboard generates OpenStack RC file download scripts that do not sanitize project names. An operator can craft a project name containing shell metacharacters, which then appear unescaped in the generated shell script. When a user downloads and sources the script, the embedded metacharacters execute as shell commands. The issue is classified under CWE-78 (OS Command Injection). The OpenStack Security Team notes that some parties consider this a security hardening opportunity addressing user error rather than a traditional vulnerability.

Critical Impact
A privileged operator can inject shell commands into RC download scripts that execute on the workstation of any user who sources the file.

Affected Products

OpenStack Horizon versions prior to 25.7.4
OpenStack deployments using the Horizon dashboard for RC file generation
Downstream distributions packaging vulnerable Horizon releases

Discovery Timeline

2026-06-17 - CVE-2026-55748 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-55748

Vulnerability Analysis

OpenStack Horizon allows users to download an OpenStack RC file containing environment variables for authenticating against the cloud API. Horizon generates this file as a shell script that embeds the project name in variable assignments and inline comments. The project name passes through to the rendered script without quoting or escaping of shell metacharacters such as backticks, $(), ;, or |.

When a user later sources the RC file with source openrc.sh, the shell evaluates any embedded metacharacters. This converts a stored project name into arbitrary command execution on the user's workstation. Successful exploitation requires high privileges to create or rename projects, and it requires a victim to download and execute the resulting script.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The script template treats the project name as trusted data when it is in fact attacker-controllable input persisted at project creation time.

Attack Vector

An attacker with permission to create or rename a project sets the project name to a string containing shell metacharacters. Any user with access to that project who downloads the RC file and sources it in a shell will execute the injected commands under their own user context.

The vulnerability is described in detail in the OpenStack Security Notice OSSN-0097 and the Launchpad Bug Report 2152240. No public proof-of-concept code is currently associated with this CVE.

Detection Methods for CVE-2026-55748

Indicators of Compromise

Project names in Keystone containing backticks, $(...), semicolons, pipes, or other shell metacharacters
Downloaded openrc.sh files whose variable assignments include unquoted command substitutions
Unexpected child processes spawned by interactive shells immediately after a user sources an RC file

Detection Strategies

Query the Keystone project list and flag any project name that fails a strict allowlist of alphanumerics, dashes, and underscores
Inspect generated RC files for shell metacharacters outside of quoted string contents
Review Horizon audit logs for project create and update events that introduce unusual characters in the name field

Monitoring Recommendations

Alert on Keystone API calls that create or rename projects with non-standard characters in the project name
Monitor operator workstations for shell process trees whose parent is a sourced RC file
Track downloads of openrc.sh artifacts from Horizon and correlate with subsequent process activity on the requesting client

How to Mitigate CVE-2026-55748

Immediate Actions Required

Upgrade OpenStack Horizon to version 25.7.4 or later, which sanitizes project names in generated RC scripts
Audit existing Keystone projects and rename any that contain shell metacharacters
Instruct users to inspect downloaded RC files before sourcing them in a shell

Patch Information

The fix is included in OpenStack Horizon 25.7.4 and later releases. Refer to the Launchpad bug report and the OpenStack Security Notice OSSN-0097 for upstream patch references and backport guidance for supported branches.

Workarounds

Restrict project creation and rename permissions to a small set of trusted administrators via Keystone policy
Enforce a project naming policy at the identity layer that rejects shell metacharacters before storage
Have users review RC files in a text editor and confirm that all values are single-quoted before executing source

bash

# Example naming policy validation before creating a project
PROJECT_NAME="$1"
if ! [[ "$PROJECT_NAME" =~ ^[A-Za-z0-9_-]+$ ]]; then
  echo "Invalid project name: only alphanumerics, dash, and underscore allowed" >&2
  exit 1
fi
openstack project create "$PROJECT_NAME"