An issue in the VMware datastore driver of OpenStack glance_store. (CVE-2026-51773)
Description
A vulnerability exists in the VMware datastore driver of OpenStack glance_store where an authenticated attacker can supply a crafted image location URI pointing to an external server. The _retry_request function does not validate the destination host before attaching sensitive authentication headers, potentially exposing these credentials. This issue affects multiple specific Ubuntu package versions of glance. The CVSS 3.1 score is 8.1, indicating a high severity impact on confidentiality and integrity but no impact on availability.
CVSS v3.1
Score 8.1high
Affected software
pkg:deb/ubuntu/glance?arch=source&distro=esm-infra/xenialpkg:deb/ubuntu/glance?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/glance?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/glance?arch=source&distro=jammypkg:deb/ubuntu/glance?arch=source&distro=noblepkg:deb/ubuntu/glance?arch=source&distro=stonkingpkg:deb/ubuntu/glance?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-51773 describes a security flaw in the VMware datastore driver component of OpenStack glance_store. When an authenticated user provides a maliciously crafted image location URI referencing an external server, the _retry_request function fails to properly validate the destination host. As a result, sensitive authentication headers may be sent to an unintended external host, risking credential exposure. The vulnerability affects numerous Ubuntu-specific versions of the glance package. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high confidentiality and integrity impacts.
Potential Impact
An authenticated attacker can cause the system to send sensitive authentication headers to an external server by supplying a malicious image location URI. This can lead to credential exposure and unauthorized access to sensitive information. There is no reported impact on system availability. The vulnerability affects confidentiality and integrity of the authentication process.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted image location URIs in the VMware datastore driver of glance_store. Monitor vendor channels for updates and apply patches promptly once released.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-51773
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f60a2cdf04f6566640eb
Added to database: 10/17/2026, 22:26:18 UTC
Last enriched: 10/18/2026, 00:56:41 UTC
Last updated: 10/18/2026, 00:56:41 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.