# CVE-2026-55748: OpenStack Horizon command injection in OpenRC file generation

Source: https://junglewise.ai/threats/cve-2026-55748-openstack-horizon-command-injection-in-openrc-file-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-55748 · Severity: medium · CVSS 6 · Published 2026-06-17

OpenStack Horizon, the web-based dashboard for managing OpenStack clouds, contains a vulnerability in how it generates configuration scripts for users. An administrator or project manager could create a project with a specially crafted name containing malicious commands. If a user downloads and runs the resulting configuration script on their local computer, those commands will execute, potentially allowing the attacker to take control of the user's system or steal sensitive data.

Technologies: [horizon (PyPI)](https://junglewise.ai/threats/technologies/horizon). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-55748 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55748 being exploited in the wild.

**How severe is CVE-2026-55748?** Medium severity, with a CVSS score of 6, published 17 June 2026.

**Which products and versions are affected?** horizon (PyPI) <= 25.7.3, ECOSYSTEM:introduced=0,last_affected=25.7.3.

**Is there a fix for CVE-2026-55748?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-55748 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55748?** Check whether you run horizon (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability (CWE-78) exists in OpenStack Horizon's OpenRC file generation. The dashboard uses double quotes to wrap user-provided project names in the generated shell scripts without escaping shell metacharacters like $() or backticks. An attacker with project-naming privileges (typically a domain manager) can craft a project name containing a malicious payload. When a victim downloads this RC file and executes it using the 'source' command in a shell, the embedded commands are executed with the victim's privileges. The issue is addressed in versions 25.3.3, 25.5.3, and 25.7.4 by switching to single-quote wrapping for values in the script templates.

## Affected products

- OpenStack Horizon >=8.0.0 <25.3.3, >=25.4.0 <25.5.3, >=25.6.0 <25.7.4

## Identifiers

- CVE-2026-55748
- GHSA-6wrm-x65g-hr4p
- PYSEC-2026-2519

## Timeline

- 2026-05-12: disclosed: Bug reported on Launchpad
- 2026-06-17: advisory: CVE published and OSSN-0097 released

## References

- [https://launchpad.net/bugs/2152240](https://launchpad.net/bugs/2152240)
- [https://wiki.openstack.org/wiki/OSSN/OSSN-0097](https://wiki.openstack.org/wiki/OSSN/OSSN-0097)

## Related threats

- [PYSEC-2026-821 - OpenStack Horizon Cross-site Scripting (XSS)](https://junglewise.ai/threats/cve-2017-7400-openstack-horizon-cross-site-scripting-xss)
- [PYSEC-2026-822 - OpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting](https://junglewise.ai/threats/cve-2014-0157-openstack-dashboard-aka-horizon-vulnerable-to-cross-site-scripting)
- [PYSEC-2026-642 - Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name](https://junglewise.ai/threats/cve-2014-3473-horizon-orchestration-cross-site-scripting-xss-vulnerability)
- [PYSEC-2026-644 - OpenStack Horizon Cross-site scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2014-3474-openstack-horizon-cross-site-scripting-xss-vulnerability)
- [PYSEC-2026-641 - OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface](https://junglewise.ai/threats/cve-2014-3594-openstack-dashboard-horizon-cross-site-scripting-xss-vulnerability)