What’s Vulnerable › Vulnerabilities

CVE-2020-26943

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-10-16 · updated 2026-06-17

Description

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.

Affected products

• OpenStack Blazar-Dashboard: before 1.3.1; 2.0.0, 3.0.0 — fixed in 1.3.1

How to fix

Upgrade to a fixed version: OpenStack Blazar-Dashboard 1.3.1. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2020/10/16/5
• https://launchpad.net/bugs/1895688
• https://review.opendev.org/755810
• https://review.opendev.org/755812
• https://review.opendev.org/755813
• https://review.opendev.org/755814
• https://review.opendev.org/756064
• https://security.openstack.org/ossa/OSSA-2020-007.html
• http://www.openwall.com/lists/oss-security/2020/10/16/5
• https://launchpad.net/bugs/1895688
• https://review.opendev.org/755810
• https://review.opendev.org/755812

Get alerted when CVE-2020-26943 or the next vulnerability affects your stack