EXPLOIT/ALERT Back to feed

Horizon vulnerability

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.

Published 17 Jun 2026Updated 22 Sep 20262 sources
CVSS 6.0
Overview Sources History

What happened

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.

Affected versions

Horizon: 8.0.0 through before 25.3.3 (semver); 25.4.0 through before 25.5.3 (semver); 25.6.0 through before 25.7.4 (semver) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

  • Apply vendor-provided updates or mitigations.
  • Review affected product exposure and access logs.

Public PoC references

No public PoC reference has passed the current publication threshold.

CorrectionsReport an issue