CVE-2026-71198: CWE-918 Server-Side Request Forgery (SSRF) in OpenStack Glance
CVE-2026-71198 is a Server-Side Request Forgery (SSRF) vulnerability in OpenStack Glance before version 32.0.1. The flaw exists in the location API, which does not properly validate destination hosts when adding an HTTP location to an image. Authenticated users can exploit this to access internal endpoints such as the cloud metadata service. This affects both the new POST /v2/images/{id}/locations API and the old PATCH API when show_multiple_locations is enabled, specifically in deployments using the HTTP store backend.
AI Analysis
Technical Summary
OpenStack Glance versions prior to 32.0.1 have an SSRF vulnerability (CWE-918) in the location API. The API fails to validate destination hosts properly when adding HTTP locations to images, only checking the URL scheme and not applying host restrictions enforced in other import paths. This allows an authenticated user to add locations pointing to internal services like the cloud metadata service (169.254.169.254) and retrieve data by downloading the image. Both the new POST and old PATCH APIs are affected under certain configurations, impacting deployments with the HTTP store backend enabled.
Potential Impact
An authenticated attacker can exploit this vulnerability to make the Glance service perform HTTP requests to internal network endpoints, such as the cloud metadata service. This can lead to unauthorized access to sensitive internal information. The vulnerability has a high severity with a CVSS 4.0 score of 7.0, indicating significant risk but requiring authentication and low attack complexity.
Mitigation Recommendations
A fix is available in OpenStack Glance version 32.0.1 and later. Users should upgrade affected deployments to version 32.0.1 or newer to remediate this vulnerability. No additional mitigation guidance is provided, and no known exploits are reported in the wild.
CVE-2026-71198: CWE-918 Server-Side Request Forgery (SSRF) in OpenStack Glance
Description
CVE-2026-71198 is a Server-Side Request Forgery (SSRF) vulnerability in OpenStack Glance before version 32.0.1. The flaw exists in the location API, which does not properly validate destination hosts when adding an HTTP location to an image. Authenticated users can exploit this to access internal endpoints such as the cloud metadata service. This affects both the new POST /v2/images/{id}/locations API and the old PATCH API when show_multiple_locations is enabled, specifically in deployments using the HTTP store backend.
CVSS v4.0
Score 7.0high
Affected software
OpenStack
Glance
pkg:github/openstack/glanceRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenStack Glance versions prior to 32.0.1 have an SSRF vulnerability (CWE-918) in the location API. The API fails to validate destination hosts properly when adding HTTP locations to images, only checking the URL scheme and not applying host restrictions enforced in other import paths. This allows an authenticated user to add locations pointing to internal services like the cloud metadata service (169.254.169.254) and retrieve data by downloading the image. Both the new POST and old PATCH APIs are affected under certain configurations, impacting deployments with the HTTP store backend enabled.
Potential Impact
An authenticated attacker can exploit this vulnerability to make the Glance service perform HTTP requests to internal network endpoints, such as the cloud metadata service. This can lead to unauthorized access to sensitive internal information. The vulnerability has a high severity with a CVSS 4.0 score of 7.0, indicating significant risk but requiring authentication and low attack complexity.
Mitigation Recommendations
A fix is available in OpenStack Glance version 32.0.1 and later. Users should upgrade affected deployments to version 32.0.1 or newer to remediate this vulnerability. No additional mitigation guidance is provided, and no known exploits are reported in the wild.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-08-05T05:52:48.170Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa79f7b55bf5e2cf5b17a1b
Added to database: 09/14/2026, 07:17:15 UTC
Last enriched: 09/14/2026, 07:31:33 UTC
Last updated: 09/14/2026, 07:48:23 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.