Threat Intelligence Database

CVE-2026-71198 is a server-side request forgery (SSRF) vulnerability in OpenStack Glance before version 32.0.1. The flaw exists in the location API, which fails to validate destination hosts when adding an HTTP location to an image. This allows an authenticated user to add locations pointing to internal endpoints such as the cloud metadata service and retrieve data by downloading the image. Both the new POST /v2/images/{id}/locations API and the old PATCH API (when show_multiple_locations is enabled) are affected. Deployments using the HTTP store backend are vulnerable.

CVE-2026-77648 is a server-side request forgery (SSRF) vulnerability in OpenStack Glance affecting versions 30.0.0 through 32.0.0. It occurs in the /v2/tasks API when handling import tasks, allowing an admin user to fetch internal URLs within the Glance service network. This API is restricted to admin users and has been deprecated for several releases. The vulnerability has a low CVSS score of 2.2 and results in limited information disclosure without impacting confidentiality, integrity, or availability beyond that.

Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.

OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.