CVE-2026-34881
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
OpenStack Glance before versions 29.1.1, 30.1.1, and 31.0.0 is vulnerable to Server-Side Request Forgery (SSRF). An authenticated user can bypass URL validation checks using HTTP redirects to access internal services. The vulnerability affects only the image import functionality, specifically the web-download and glance-download import methods, as well as the optional ovf_process plugin.
Risk Assessment
The risk involves potential scanning and attacking of internal network resources, which could lead to data leakage, privilege escalation, or disruption of other cloud services.
Recommendation
Immediately update OpenStack Glance to version 29.1.1, 30.1.1, or later. If an update is not possible, temporarily disable the image import functionality or restrict access to trusted users only.
Other vulnerabilities in OpenStack Glance
See all- CVE-2026-51772Medium
A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted HTTP PATCH request.
- CVE-2026-71198High
In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254) and retrieve the response by downloading the image data.
- CVE-2026-77648Low
OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (SSRF).
- CVE-2017-7200Medium
OpenStack Glance before Newton has an SSRF vulnerability in the 'copy_from' feature of the Image Service API v1. An attacker can create images with URLs like 'http://localhost:22' to perform masked internal port scans.
Original NVD description (English source)
OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS