CVE-2020-26943

CRITICAL

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the ...

Affects 1 product across 1 vendor.

CVSS 3.19.9
EPSS3.3%
Percentile88th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in OpenStack blazar-dashboard versions before 1.3.1, 2.0.0, and 3.0.0 allows unauthorized code execution on the Horizon host due to the use of the Python eval function.

BSID: BS-2020-GLOBAL-149541-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-26943?
A critical vulnerability in OpenStack blazar-dashboard versions before 1.3.1, 2.0.0, and 3.0.0 allows unauthorized code execution on the Horizon host due to the use of the Python eval function.
What is the CVSS score for CVE-2020-26943?
CVE-2020-26943 has CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS: 3.3%.
Is CVE-2020-26943 actively exploited?
No confirmed active exploitation of CVE-2020-26943 as of 2026-05-30.
How do I remediate CVE-2020-26943?
Priority: IMMEDIATE.
What systems are affected by CVE-2020-26943?
CVE-2020-26943 affects Openstack Blazar-Dashboard.
Vulnerability Details
CVE IDCVE-2020-26943
BSIDBS-2020-GLOBAL-149541-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published2020-10-16
Last Modified2024-11-21
ICS Relevance0%
SourceNVD
Official Description

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker with access to the Blazar dashboard in Horizon can execute arbitrary code on the Horizon host, potentially leading to unauthorized access and further compromise of the Horizon service.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Openstack Blazar-Dashboard 2.0.0 3.0.0 < 1.3.1
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2191 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash960b75b09ac5df9cf047394cf2640a2d23487520fb846479a34935721fd22a1896b297419cabf3616b8fbb137ff5cff1a369a213fa4c99ba879ac3e7a100a941
Related CVEs affecting Openstack
CVE-2025-59823 9.9 Project Gardener implements the automated management and operation of Kuberne... CVE-2026-22797 9.9 An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 bef... CVE-2017-16613 9.8 An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 wh... CVE-2012-4406 9.8 OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the ... CVE-2016-4972 9.8 OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano...
View all Openstack CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →