Executive brief
OpenStack Horizon, the web-based dashboard for managing OpenStack clouds, contains a vulnerability in how it generates configuration scripts for users. An administrator or project manager could create a project with a specially crafted name containing malicious commands. If a user downloads and runs the resulting configuration script on their local computer, those commands will execute, potentially allowing the attacker to take control of the user's system or steal sensitive data.
Technical details
A command injection vulnerability (CWE-78) exists in OpenStack Horizon's OpenRC file generation. The dashboard uses double quotes to wrap user-provided project names in the generated shell scripts without escaping shell metacharacters like $() or backticks. An attacker with project-naming privileges (typically a domain manager) can craft a project name containing a malicious payload. When a victim downloads this RC file and executes it using the 'source' command in a shell, the embedded commands are executed with the victim's privileges. The issue is addressed in versions 25.3.3, 25.5.3, and 25.7.4 by switching to single-quote wrapping for values in the script templates.
Affected products
- OpenStack Horizon >=8.0.0 <25.3.3, >=25.4.0 <25.5.3, >=25.6.0 <25.7.4
Timeline
- 2026-05-12: disclosed: Bug reported on Launchpad
- 2026-06-17: advisory: CVE published and OSSN-0097 released