CVE-2017-7200
MediumCVSS 5.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
OpenStack Glance before Newton has an SSRF vulnerability in the 'copy_from' feature of the Image Service API v1. An attacker can create images with URLs like 'http://localhost:22' to perform masked internal port scans.
Risk Assessment
An attacker can gather internal network details such as open ports, which may facilitate further attacks.
Recommendation
Update OpenStack Glance to Newton or later which includes the fix.
Other vulnerabilities in OpenStack Glance
See all- CVE-2026-71198High
In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254) and retrieve the response by downloading the image data.
- CVE-2026-77648Low
OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (SSRF).
- CVE-2026-34881Medium
OpenStack Glance before versions 29.1.1, 30.1.1, and 31.0.0 is vulnerable to Server-Side Request Forgery (SSRF). An authenticated user can bypass URL validation checks using HTTP redirects to access internal services. The vulnerability affects only the image import functionality, specifically the web-download and glance-download import methods, as well as the optional ovf_process plugin.
Original NVD description (English source)
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.