CVE-2026-55748 OpenStack Horizon RC file generation does not escape special characters in project names

What is CVE-2026-55748?

CVE-2026-55748 is a medium-severity command injection vulnerability in OpenStack Horizon, published on 17 Jun 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.

Weakness: CWE-78

Which versions are affected by CVE-2026-55748?

3 open source packages ship an affected version, including horizon. It affects 1 product.

Products include Openstack Horizon.

How do I fix CVE-2026-55748?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-55748 being exploited?

There is no known exploitation of CVE-2026-55748 in the wild and no public exploit code.

Other vulnerabilities in OpenStack Horizon

• CVE-2012-2144 OpenStack Horizon Session Fixation Medium 6.8
• CVE-2022-45582 Horizon Web Dashboard Open Redirect vulnerability Medium 6.1
• CVE-2012-3540 Open redirect in n/a Medium 5.8
• CVE-2013-4471 Auth bypass in n/a Medium 5.5
• CVE-2026-43002 OpenStack Horizon has Incorrect Behavior Order Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-55748, GHSA-6wrm-x65g-hr4p, PYSEC-2026-2519, UBUNTU-CVE-2026-55748.