CVE-2014-3594: Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon)...

Security readout for executives and security teams

This is a stored XSS flaw in OpenStack Dashboard (Horizon). An authenticated remote administrator could create a host aggregate name that causes script or HTML to run in the dashboard. The business risk is limited by the administrator prerequisite, but exposed cloud management consoles should treat it seriously because administrator sessions and trust boundaries are involved. Exposure is mainly OpenStack deployments running affected Horizon versions with Host Aggregates available to administrators. Internet-facing or broadly accessible dashboard deployments carry higher practical risk, but the cited description requires remote administrator access. Prioritize remediation for exposed or multi-admin OpenStack dashboards. This is not evidenced as actively exploited in the bundle, but it affects a privileged cloud management surface where session compromise or administrative deception could have outsized operational impact. Mitigation focus: Upgrade Horizon to 2013.2.4, 2014.1.2, Juno-3, or later fixed releases.; Apply relevant vendor security advisories, including Red Hat or openSUSE packages where applicable.; Restrict Horizon administrator access to trusted users and management networks..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.