medium6.0
CVE-2026-55748
OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters.
Impact
OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | horizon | <= 25.7.3 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openstack | Horizon | from 8.0.0 before 25.3.3 from 25.4.0 before 25.5.3 from 25.6.0 before 25.7.4 |