Executive brief
A vulnerability in the OpenStack Horizon dashboard allows unauthenticated users to crash the service by flooding it with simple web requests. By repeatedly accessing the login page with a specific web parameter, an attacker can fill up the server's memory or database with temporary session data. This results in a denial-of-service where legitimate administrators are logged out and cannot regain access to manage their cloud infrastructure.
Technical details
A denial-of-service vulnerability exists in OpenStack Horizon due to a regression of a previous fix (CVE-2014-8124). The 'login' view in 'openstack_auth/views.py' incorrectly writes a 'post_login_redirect' URL to the session storage backend before a user has authenticated. Because Django's SessionMiddleware persists a new session record whenever the session dictionary is modified, an unauthenticated attacker can send repeated GET requests to '/auth/login/?next=URL' without a session cookie to force the creation of unbounded session records. This can exhaust backends such as Memcached, Redis, or SQL databases, leading to the eviction of legitimate sessions or service failure. The issue is fixed in version 25.7.3 by moving the redirect storage out of the server-side session.
Affected products
- OpenStack Horizon >=25.6.0 <25.7.3
Timeline
- 2026-04-25: disclosed: Bug reported to OpenStack Launchpad
- 2026-04-27: advisory: OpenStack Security Advisory OSSA-2026-009 issued
- 2026-05-05: patched: CVE published and fix released in version 25.7.3