OpenStack Glance versions before 29.1.1, 30.x before 30.1.1, and 31.0.0 contain a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in the image import functionality. Authenticated users can exploit insufficient URI validation by leveraging HTTP redirects or alternative IP encodings to bypass URL validation checks. This enables attackers to access internal network services and potentially exfiltrate sensitive data. The vulnerability specifically affects the web-download and glance-download import methods and the optional ovf_process plugin. Red Hat's advisory confirms the issue and rates it as important, providing updated packages for Red Hat OpenStack Services on OpenShift 18.0. The advisory notes that mitigation options are limited or do not fully meet Red Hat's standards, emphasizing the need to apply the provided security updates.

Successful exploitation allows an authenticated attacker to bypass URL validation and access internal network resources that are otherwise protected. This can lead to unauthorized internal network access and potential exfiltration of sensitive information within the cloud environment. The vulnerability impacts confidentiality and integrity by enabling unauthorized access and manipulation of internal services. The CVSS v3.1 base score is 5.0 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and availability.

Red Hat has released security updates for OpenStack Glance addressing this SSRF vulnerability. Applying these official patches is the recommended remediation. Currently, no alternative mitigations fully meet Red Hat's criteria for ease of use, applicability, or stability. Users should prioritize updating to the fixed versions as detailed in the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-34881 and https://access.redhat.com/errata/RHSA-2026:39812).