A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance when the show_multiple_locations configuration option is enabled. An authenticated attacker can manipulate the locations attribute of an image in the queued state via a crafted HTTP PATCH request. This vulnerability has a medium severity with a CVSS score of 6.5, impacting confidentiality but not integrity or availability.