CVE-2026-43002

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://bugs.launchpad.net/horizon/+bug/2150331	Exploit Issue Tracking Vendor Advisory
https://security.openstack.org/ossa/OSSA-2026-009.html	Patch Vendor Advisory
https://www.openwall.com/lists/oss-security/2026/05/05/7	Mailing List Patch Third Party Advisory
https://bugs.launchpad.net/horizon/+bug/2150331	Exploit Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-05 17:17

Updated : 2026-09-10 21:22

NVD link : CVE-2026-43002

Mitre link : CVE-2026-43002

CVE.ORG link : CVE-2026-43002

JSON object : View

Products Affected

openstack

horizon

CWE

CWE-696

Incorrect Behavior Order

{"id": "CVE-2026-43002", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43002", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-05T17:26:54.895377Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "OpenStack", "product": "Horizon", "versions": [{"status": "affected", "version": "25.6.0", "lessThan": "25.7.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-05T17:17:04.920", "references": [{"url": "https://bugs.launchpad.net/horizon/+bug/2150331", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-009.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2026/05/05/7", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugs.launchpad.net/horizon/+bug/2150331", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-696"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en OpenStack Horizon 25.6 y 25.7 antes de la versi\u00f3n 25.7.3. Hay una operaci\u00f3n de escritura en el backend de almacenamiento de la sesi\u00f3n antes de la autenticaci\u00f3n y, por lo tanto, el almacenamiento puede ser agotado por solicitudes no autenticadas. Esto es una regresi\u00f3n de la correcci\u00f3n de CVE-2014-8124."}], "lastModified": "2026-09-10T21:22:48.593", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0972CDB0-4351-4FAA-87B8-A3BB6DAF3017", "versionEndExcluding": "25.7.3", "versionStartIncluding": "25.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}