CVE-2020-26943
A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used).
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.29%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
- CVSS 3.1
- 9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 3.29% probability · 88th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Affected
- openstack/blazar-dashboard
- Source
- cve@mitre.org
EPSS 3.3% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://www.openwall.com/lists/oss-security/2020/10/16/5Third Party Advisory
- https://launchpad.net/bugs/1895688Third Party Advisory
- https://review.opendev.org/755810Third Party Advisory
- https://review.opendev.org/755812Third Party Advisory
- https://review.opendev.org/755813Third Party Advisory
- https://review.opendev.org/755814Third Party Advisory
- https://review.opendev.org/756064Third Party Advisory
- https://security.openstack.org/ossa/OSSA-2020-007.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2020/10/16/5Third Party Advisory
- https://launchpad.net/bugs/1895688Third Party Advisory
- https://review.opendev.org/755810Third Party Advisory
- https://review.opendev.org/755812Third Party Advisory
- https://review.opendev.org/755813Third Party Advisory
- https://review.opendev.org/755814Third Party Advisory
- https://review.opendev.org/756064Third Party Advisory
- https://security.openstack.org/ossa/OSSA-2020-007.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.