Bug 2489863 (CVE-2026-55748) - CVE-2026-55748 OpenStack Horizon: OpenStack Horizon: Information disclosure or integrity compromise via crafted project name with shell metacharacters
Summary: CVE-2026-55748 OpenStack Horizon: OpenStack Horizon: Information disclosure o...
Keywords:
Status: NEW
Alias: CVE-2026-55748
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-17 16:01 UTC by OSIDB Bzimport
Modified: 2026-06-18 08:27 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-06-17 16:01:50 UTC 
OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.
Note You need to log in before you can comment on or make changes to this bug.