CVE-2026-43002: OpenStack Horizon Session Storage Exhaustion Vulnerability
Summary
CVE-2026-43002: OpenStack Horizon has Incorrect Behavior Order. Affects horizon versions >= 25.6, < 25.7.3. Fixed in 25.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenStack Horizon is the web-based dashboard for OpenStack, allowing users to manage cloud resources through a user-friendly interface. It provides functionalities such as managing instances, networks, and storage. However, certain versions of Horizon are vulnerable to a session storage exhaustion issue, which can be exploited by unauthenticated users.
Vulnerability Detail
An issue was discovered in OpenStack Horizon versions 25.6 and 25.7 prior to 25.7.3, where a write operation to the session storage backend occurs before user authentication. This flaw allows unauthenticated requests to fill up the session storage, potentially leading to denial of service as legitimate users may be unable to store their session data. This vulnerability is a regression of the fix for CVE-2014-8124.
How To Fix
Latest published version: 27.0.0 as of 22 Oct 2026
pip install --upgrade "horizon==27.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
25.7.3
This is the first release that contains the fix.
pip install --upgrade "horizon==25.7.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on session storage writes to mitigate the risk of exhaustion from unauthenticated requests. This can be done by configuring your web server or application settings to limit the number of session writes per IP address.
Conclusion
The vulnerability identified as CVE-2026-43002 in OpenStack Horizon poses a risk of session storage exhaustion due to improper handling of unauthenticated requests. Users are advised to update to the latest version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for horizon →
FAQ
OpenStack Horizon versions 25.6 and 25.7 before 25.7.3 are affected by this vulnerability.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary consequence is the exhaustion of session storage, which can prevent legitimate users from storing their session data, leading to denial of service.
Yes, the permanent fix is to update to Horizon version 25.7.3 or later, which addresses the issue.
Related vulnerabilities
Recent vulnerabilities recorded for horizon.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
