CVE-2026-43002

Executive Summary

CVE-2026-43002 is a denial-of-service (DoS) vulnerability affecting the OpenStack Horizon web dashboard, specifically versions 25.6 and 25.7 prior to 25.7.3. The flaw allows unauthenticated remote attackers to exhaust the session storage backend by triggering write operations before authentication occurs, resulting in a full denial of service for legitimate users. This issue is a regression of the previously patched CVE-2014-8124, indicating a failure in maintaining the original security fix across newer code branches. Enterprise environments operating multi-tenant OpenStack clouds with Horizon exposed to untrusted networks face the highest risk, as a single attacker can render the dashboard and all dependent services unusable.

Technical Analysis

The vulnerability resides in the session handling middleware of OpenStack Horizon, the web-based management interface for OpenStack services. The core mechanism is a write operation to the session storage backend that occurs during the request lifecycle before the authentication check is performed. In normal operation, Horizon stores session data—typically in a backend such as Memcached, Redis, or a database—keyed by a session ID cookie. The flaw is that under specific conditions associated with the 25.6 and 25.7 release branches, the application writes data to this backend unconditionally for any incoming request, including those that have not yet been authenticated.

The original fix for CVE-2014-8124, which addressed an identical class of issue, introduced a guard that delayed session storage writes until after the authentication middleware had validated the user's session. The regression in the 25.6/25.7 branches means that this guard was either removed, bypassed, or incorrectly reordered during a code refactor, allowing the pre-auth write to resume.

From an attacker's perspective, the write operation does not require a valid session token. Each HTTP request—even a simple GET to a static resource or an unauthenticated POST to a login endpoint—triggers an allocation of storage space in the backend. The attack is probabilistic and cumulative: the attacker does not need to cause a single catastrophic allocation; rather, they need to generate a high volume of requests (or requests that cause proportionally large session blobs) to fill the storage backend's capacity limits.

The attack surface is the HTTP interface of Horizon, typically exposed on TCP port 80 or 443. In a default deployment, Horizon is fronted by a web server (Apache or Nginx) and a WSGI server (uWSGI or Gunicorn). The backend session storage is often Memcached, which has a finite memory pool. Once the memory pool is exhausted, Memcached evicts existing keys, including active user sessions. This causes legitimate users to be forced to re-authenticate, and in a cascading fashion, as users' sessions are evicted and they re-login, additional write pressure is generated, potentially exacerbating the situation. If the backend is a relational database, the effect is disk space exhaustion and degraded query performance.

Exploitation Scenarios

The following attack chain is a plausible exploitation scenario against a vulnerable OpenStack Horizon deployment:

1. Reconnaissance and Target Identification: The attacker uses passive and active scanning to identify OpenStack Horizon instances. OpenStack Horizon has distinctive HTTP response headers (e.g., Server: nginx with Horizon in the X-Frame-Options or cookie names like sessionid and horizon). Shodan and FOFA queries using http.title:"Horizon" or http.favicon.hash values associated with Horizon dashboards can identify candidates. Port scanning confirms TCP 80/443 is open.

2. Weaponization and Trigger: The attacker crafts a simple HTTP request without any authentication tokens. A single GET / request is sufficient to trigger the vulnerable write path. However, to amplify the effect, the attacker can issue requests that generate larger session blobs. For example, requests to dynamic pages that store data in the session—such as the login form's CSRF token handling—may cause larger writes. The attacker uses a distributed set of IP addresses to avoid rate-limiting by the web server.

3. Payload and Execution: The attacker executes a flooding script (e.g., a Python requests-based loop, ab (Apache Bench), or wrk) targeting the Horizon endpoint. The script sends thousands of requests per second. Each request causes a write operation to the session storage backend, consuming memory or disk. The attacker maintains this flood for an extended period (minutes to hours). Critically, the attacker does not need valid credentials; all requests are unauthenticated.

4. Post-Exploitation Impact: As the session storage backend fills, Memcached begins evicting existing sessions (LRU eviction). Legitimate users are logged out and receive errors when attempting to interact with the dashboard. In database-backed deployments, the disk fills, causing write failures across the OpenStack control plane (e.g., Keystone authentication tokens recorded in the same database may fail to persist). The dashboard becomes unusable. The attacker has achieved a sustained denial-of-service condition. In multi-tenant clouds, this affects all tenants and cloud administrators, halting day-to-day operations and potentially impacting revenue if the cloud is commercial.

Impact Assessment

The CVSS 3.1 base score is 5.3 (Medium severity). The attack vector is network-based (AV:N), requires no privileges (PR:N), and involves no user interaction (UI:N). The primary impact is on availability (A:H), while confidentiality and integrity are unaffected (C:N/I:N).

The scope of impact is broad for any organization running OpenStack with Horizon. The dashboard is the primary interface for cloud tenants and administrators to manage virtual machines, networks, storage, and other resources. A DoS condition effectively shuts down the management plane, preventing users from creating, deleting, or modifying resources. Users may also be locked out of existing resources if token renewal depends on sessions that are evicted.

Operational impact includes:

• Service unavailability for all Horizon users.
• Cascading failures if the session backend (e.g., Memcached) is shared with other OpenStack services (Keystone tokens, Nova cells).
• Operational overhead for incident response and manual mitigation.
• Reputational damage for commercial cloud providers.

The attack is trivial to execute (a single script), requires minimal resources from the attacker, and has a high success probability given the lack of authentication prerequisite. The medium severity rating understates the practical risk because the attack is unauthenticated and the effort-to-impact ratio is highly favorable to the attacker.

Detection Guidance

Detection of this attack focuses on identifying anomalous traffic patterns (high request rate from single/coordinated IPs, excessive session creation) and anomalies in the session storage backend (memory/disk growth, eviction rates).

Sigma Rule

title: High Volume of Unauthenticated Requests to OpenStack Horizon
id: 72a91d22-c6a0-4d9e-9d8a-2f1a3b4c5d6e
status: experimental
description: Detects a high rate of requests to OpenStack Horizon endpoints that may indicate session storage exhaustion (CVE-2026-43002).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-43002
tags:
    - attack.t1498
    - attack.t1499
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        sc-status: 200
        http.method: 'GET' OR 'POST'
    condition: selection | count() by src_ip > 1000 span=1m
    timeframe: 1m
level: medium
falsepositives:
    - Load testing tools used internally
    - Aggressive web crawlers
fields:
    - src_ip
    - http_user_agent
    - request_uri
    - sc_status

YARA Rule

rule Detect_Horizon_Session_Exhaustion_Likely
{
    meta:
        description = "Detects patterns in HTTP traffic indicative of session storage exhaustion attempts against OpenStack Horizon"
        author = "Valtersit Threat Intelligence"
        date = "2026-02-15"
        reference = "CVE-2026-43002"
        score = 50
    strings:
        $s1 = "sessionid" ascii wide nocase
        $s2 = "horizon" ascii wide nocase
        $s3 = "login" ascii wide nocase
        $s4 = "POST" ascii wide
        $s5 = "GET" ascii wide
    condition:
        any of them and #s1 > 10
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET POLICY OpenStack Horizon High Request Rate - Potential DoS CVE-2026-43002"; flow:established,to_server; content:"|0d 0a|"; http_header_names; content:"Host"; nocase; http_header; content:"|0d 0a|"; http_header_names; content:"User-Agent"; nocase; http_header; threshold:type both, track by_src, count 1000, seconds 60; classtype:attempted-dos; sid:2026430; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where network.protocol == "http" and http.response.status_code == 200]
  [network where network.protocol == "http" and http.response.status_code == 200] with runs=1000

Alternative, count-based query:

any where network.protocol == "http" and http.response.status_code == 200
| stats count by source.ip
| where count > 1000 @timestamp = now-1m

Splunk SPL Query

index=webserver sourcetype=access_combined
| stats count by src_ip, uri
| where count > 1000
| lookup openstack_horizon_uri uri as uri OUTPUT if_match
| where if_match == "enabled"
| table _time, src_ip, uri, count

This query assumes an lookup table (openstack_horizon_uri) that identifies Horizon-specific URIs. Alternatively, filter by known Horizon paths: /auth/login/, /dashboard/, /horizon/.

Wazuh OSSEC Rule

<group name="openstack,horizon,dos,">
  <rule id="100430" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.module">nginx</field>
    <field name="http.response.status_code">200</field>
    <description>OpenStack Horizon: High volume of unauthenticated requests detected from $(src_ip). Potential session storage exhaustion (CVE-2026-43002).</description>
    <group>attack.dos,</group>
    <if_sid>100000</if_sid> <!-- Base rule for web access -->
  </rule>
</group>

Note: Wazuh rules require a frequency-based correlation in the manager, which is configured in ossec.conf via <frequency> and <timeframe> elements, not directly in the rule XML.

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source (Debian) claims a patch, not independently confirmed).

1. Immediate Mitigations (in lieu of or prior to patching):

   • Rate Limiting: Implement strict rate limiting at the web server (Nginx limit_req or Apache mod_evasive) or a WAF (e.g., ModSecurity) for unauthenticated requests. Limit to a low threshold (e.g., 10 requests/minute per IP) on Horizon endpoints.
   • IP Blacklisting: Monitor request logs and dynamically blacklist IPs that exceed an aggressive threshold. This is a stopgap and can be bypassed with IP rotation.
   • Backend Hardening: Configure session backend to reject writes when capacity exceeds a threshold. For Memcached, use -o modern and set memory limits; implement connection limits. For databases, enforce max storage.
   • Network Segmentation: Restrict access to Horizon to trusted networks (VPN or management VLAN) using firewall rules. Do not expose Horizon directly to the internet.

2. Patch/Upgrade Steps:

   • Upgrade OpenStack Horizon to version 25.7.3 or later, which contains the fix re-applying the CVE-2014-8124 regression. Verify the upgrade in a staging environment first.
   • For Debian-based deployments, apply the Debian security patch for horizon package. Refer to the Debian Security Tracker for the exact version number (e.g., 17.3.3 for the corresponding release).
   • Confirm the patch by checking the package version: dpkg -l | grep horizon (Debian) or pip show horizon (Python package). The installed version must be >= 25.7.3.

3. Long-term Hardening:

   • Restrict Horizon network access using a VPN or dedicated bastion host.
   • Implement a Web Application Firewall (WAF) with bot management to detect and block volumetric attacks.
   • Perform regular security regression testing, specifically for previously patched vulnerabilities (CVE-2014-8124) when new versions are adopted.
   • Monitor the session storage backend for abnormal growth using monitoring tools (e.g., Prometheus, Grafana). Set alerts on Memcached eviction rates and memory usage.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-43002
• Original CVE-2014-8124 NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2014-8124
• Debian Security Tracker (for patch confirmation): https://security-tracker.debian.org/tracker/CVE-2026-43002
• OpenStack Horizon Documentation (for upgrade instructions): https://docs.openstack.org/horizon/latest/

Threat Actor Activity: There is no evidence of active exploitation, zero-day campaigns, or public exploit code for this CVE as of the report date. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. However, the ease of exploitation (unauthenticated) and the historical precedent of similar flaws (CVE-2014-8124) being exploited in the past elevate the risk, particularly for internet-facing deployments. EPSS score of 0.00365 indicates a low exploitation probability at this time, but this may change.