CVE-2026-43002: Horizon Package Suffers from Incorrect Behavior Order Vulnerability
Summary
CVE-2026-43002: OpenStack Horizon has Incorrect Behavior Order. Affects horizon versions >= 25.6, < 25.7.3. Fixed in 25.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Horizon is a web-based dashboard that allows users to manage and interact with OpenStack services. It provides a user-friendly interface for managing cloud resources, including instances, volumes, and networks. The package is widely used in cloud environments, making it critical for maintaining security and performance. However, vulnerabilities in Horizon can lead to significant security risks, especially when they allow unauthorized access or resource exhaustion.
Vulnerability Detail
An issue was discovered in OpenStack Horizon versions 25.6 and 25.7 before 25.7.3, where a write operation to the session storage backend occurs before user authentication. This flaw allows unauthenticated requests to exhaust storage resources, potentially leading to denial of service. This vulnerability is a regression of the fix for CVE-2014-8124, indicating that previous security measures were not adequately maintained.
How To Fix
Latest published version: 27.0.0 as of 22 Oct 2026
pip install --upgrade "horizon==27.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
25.7.3
This is the first release that contains the fix.
pip install --upgrade "horizon==25.7.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on session storage requests to mitigate the impact of unauthenticated requests. This can be done by configuring your web server or application settings to limit the number of requests from a single IP address.
Conclusion
The CVE-2026-43002 vulnerability in OpenStack Horizon poses a significant risk by allowing unauthenticated requests to exhaust session storage. It is crucial to update to version 25.7.3 or later to mitigate this risk. For those unable to update immediately, implementing rate limiting can serve as a temporary measure.
See every vulnerability recorded for horizon →
FAQ
CVE-2026-43002 is a vulnerability in the OpenStack Horizon package that allows unauthenticated requests to exhaust session storage resources.
The affected versions are Horizon 25.6 and 25.7 before 25.7.3.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
If updating is not possible, consider implementing rate limiting on session storage requests as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for horizon.
