OpenStack Glance versions prior to 29.1.1, 30.1.1, and 31.0.0 contain an SSRF vulnerability (CWE-918) in the image import feature. Authenticated users can exploit HTTP redirects to circumvent URL validation, causing the service to make requests to unintended internal endpoints. The vulnerability affects the web-download and glance-download import methods and the optional ovf_process plugin. This could lead to limited impact such as information disclosure or indirect interaction with internal services, but does not affect confidentiality or availability directly according to the CVSS vector.

The vulnerability allows an authenticated user to perform SSRF attacks by bypassing URL validation through HTTP redirects in the image import functionality. The impact is limited to integrity loss (as per CVSS vector), with no direct confidentiality or availability impact reported. No known exploits have been observed in the wild, reducing immediate risk. The affected functionality is specific to image import methods, and the optional ovf_process plugin is not enabled by default, limiting exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or advisory is provided in the data, users should monitor OpenStack Glance vendor channels for updates. In the meantime, restrict access to the image import functionality to trusted users only and consider disabling the optional ovf_process plugin if enabled. Avoid using the affected import methods until a fix is available.