CVE-2026-55748 describes an OS Command Injection vulnerability in OpenStack Horizon prior to version 25.7.4. The vulnerability arises because scripts produced for OpenStack RC file downloading incorporate project names that may contain shell metacharacters without proper sanitization. This improper neutralization of special elements (CWE-78) could allow an attacker with appropriate privileges to influence OS command execution. The vulnerability requires high privileges and user interaction, with network attack vector and results in high confidentiality and integrity impact, and low availability impact. No official patch or remediation level has been provided yet.

An attacker with high privileges and user interaction could exploit crafted project names containing shell metacharacters to execute unintended OS commands when downloading OpenStack RC files. This could lead to compromise of confidentiality and integrity of the system, with limited impact on availability. However, no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with project names containing shell metacharacters and consider applying security hardening measures to limit potential exploitation.