Read the docs
TI-2026-27114 Aliases CVE-2026-34881GHSA-mc26-q38v-83gv

Server-side request forgery in OpenStack Glance

Priority MEDIUM 56CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00276 20th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Glance (OpenStack): 29.1.1, 30.1.1glance (PyPI): 29.2.0, 30.2.0, 31.1.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenStackGlancebefore 29.1.1; 30.0.0 to before 30.1.1; 31.0.029.1.1, 30.1.1Patch availableCNA
—glance (PyPI)before 29.2.029.2.0Patch availableGHSA-mc26-q38v-83gv
—glance (PyPI)30.0.0 to before 30.2.030.2.0Patch availableGHSA-mc26-q38v-83gv
—glance (PyPI)31.0.0 to before 31.1.031.1.0Patch availableGHSA-mc26-q38v-83gv
  • Glance VendorOpenStack Affected before 29.1.1; 30.0.0 to before 30.1.1; 31.0.0 Fixed in 29.1.1, 30.1.1 Patch available CNA
  • glance (PyPI) Vendor— Affected before 29.2.0 Fixed in 29.2.0 Patch available GHSA-mc26-q38v-83gv
  • glance (PyPI) Vendor— Affected 30.0.0 to before 30.2.0 Fixed in 30.2.0 Patch available GHSA-mc26-q38v-83gv
  • glance (PyPI) Vendor— Affected 31.0.0 to before 31.1.0 Fixed in 31.1.0 Patch available GHSA-mc26-q38v-83gv

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*before 29.1.1; 30.0.0 to before 30.1.1VulnerableOpenStack
cpe:2.3:a:openstack:glance:31.0.0:*:*:*:*:*:*:*31.0.0VulnerableOpenStack
  • cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:* Versions before 29.1.1; 30.0.0 to before 30.1.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:glance:31.0.0:*:*:*:*:*:*:* Versions 31.0.0 Vulnerable ·OpenStack

Remediation

  • Fix · CNA Glance (OpenStack) Fixed in 29.1.1, 30.1.1
  • Fix · GHSA-mc26-q38v-83gv glance (PyPI) Fixed in 29.2.0 Advisory →
  • Fix · GHSA-mc26-q38v-83gv glance (PyPI) Fixed in 30.2.0 Advisory →
  • Fix · GHSA-mc26-q38v-83gv glance (PyPI) Fixed in 31.1.0 Advisory →

Red Hat 2 advisories

  • RHSA-2026:54757 Released 2026-08-13 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2 security advisory
    • Red Hat OpenStack Platform 16.2 collectd-sensubility-0.2.1-1.1.el8ost, erlang-23.3.4.18-2.el8ost, erlang-asn1-23.3.4.18-2.el8ost +41
  • RHSA-2026:39812 Released 2026-07-15 · Red Hat rating Important
    Red Hat OpenStack Services on OpenShift 18.0 (openstack-glance) security update
    • Red Hat OpenStack Services on OpenShift 18.0 openstack-glance-1:26.1.1-18.0.20260422134725.c2ac316.el9ost, python3-glance-1:26.1.1-18.0.20260422134725.c2ac316.el9ost

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 17.1AffectedNo fix yet
Red Hat OpenStack Platform 16.2Fixed RHSA-2026:54757
Red Hat OpenStack Services on OpenShift 18.0Fixed RHSA-2026:39812
Not affected: 1 product
  • Red Hat OpenStack Platform 16.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34881
  2. 2026-10-03 Alias added: GHSA-mc26-q38v-83gv

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2022-23762 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and… CVSS 3.1MEDIUM 5.7
  • TI-2015-04330 The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1… CVSS 3.0HIGH 7.5
  • TI-2016-07073 Uncontrolled resource consumption in openstack-glance CVSS 3.0MEDIUM 6.5
  • TI-2013-01623 Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request CVSS 3.1MEDIUM 6.5
  • TI-2024-21386 An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and… CVSS 3.1MEDIUM 6.5
  • TI-2017-04889 An SSRF issue was discovered in OpenStack Glance before Newton. CVSS 3.1MEDIUM 5.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences