Is CVE-2026-55748 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55748 being exploited in the wild.

How severe is CVE-2026-55748?

Medium severity, with a CVSS score of 6, published 17 June 2026.

Which products and versions are affected?

horizon (PyPI) <= 25.7.3, ECOSYSTEM:introduced=0,last_affected=25.7.3.

Is there a fix for CVE-2026-55748?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-55748 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55748?

Check whether you run horizon (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55748: OpenStack Horizon command injection in OpenRC file generation

Q: Which products and versions are affected?

horizon (PyPI) <= 25.7.3, ECOSYSTEM:introduced=0,last_affected=25.7.3.

Q: Is there a fix for CVE-2026-55748?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-55748 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55748?

Check whether you run horizon (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55748 · Severity: medium · CVSS 6 · Published 2026-06-17

OpenStack Horizon, the web-based dashboard for managing OpenStack clouds, contains a vulnerability in how it generates configuration scripts for users. An administrator or project manager could create a project with a specially crafted name containing malicious commands. If a user downloads and runs the resulting configuration script on their local computer, those commands will execute, potentially allowing the attacker to take control of the user's system or steal sensitive data.

Technologies: horizon (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55748 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55748 being exploited in the wild.
How severe is CVE-2026-55748?: Medium severity, with a CVSS score of 6, published 17 June 2026.
Which products and versions are affected?: horizon (PyPI) <= 25.7.3, ECOSYSTEM:introduced=0,last_affected=25.7.3.
Is there a fix for CVE-2026-55748?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-55748 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55748?: Check whether you run horizon (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability (CWE-78) exists in OpenStack Horizon's OpenRC file generation. The dashboard uses double quotes to wrap user-provided project names in the generated shell scripts without escaping shell metacharacters like $() or backticks. An attacker with project-naming privileges (typically a domain manager) can craft a project name containing a malicious payload. When a victim downloads this RC file and executes it using the 'source' command in a shell, the embedded commands are executed with the victim's privileges. The issue is addressed in versions 25.3.3, 25.5.3, and 25.7.4 by switching to single-quote wrapping for values in the script templates.

Affected products

OpenStack Horizon >=8.0.0 <25.3.3, >=25.4.0 <25.5.3, >=25.6.0 <25.7.4

Identifiers

CVE-2026-55748
GHSA-6wrm-x65g-hr4p
PYSEC-2026-2519

Timeline

2026-05-12: disclosed: Bug reported on Launchpad
2026-06-17: advisory: CVE published and OSSN-0097 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.