CVE-2026-43002: [OSSA-2026-009] Horizon: Unauthenticated session flood via login dict storage (CVE-2026-43002)
An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Horizonto a version that resolves this vulnerability.Fixed in 25.7.3 - Compensating control
Mitigate by restricting access to the Horizon login/session endpoint (e.g., via network/edge filtering or firewall/ACL) to reduce unauthenticated requests that can exhaust the session storage backend.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43002?
CVE-2026-43002 has a high severity due to its potential to exhaust session storage via unauthenticated session floods.
How do I fix CVE-2026-43002?
To fix CVE-2026-43002, upgrade OpenStack Horizon to version 25.7.3 or later.
What versions of OpenStack Horizon are affected by CVE-2026-43002?
OpenStack Horizon versions 25.6 and 25.7.0 to 25.7.2 are affected by CVE-2026-43002.
What is the impact of CVE-2026-43002 on OpenStack Horizon?
The impact of CVE-2026-43002 is an exhaustion of session storage which can lead to denial of service.
Is authentication required to exploit CVE-2026-43002?
No, CVE-2026-43002 can be exploited without authentication.