Skip to main content

OpenStack Glance EUVDEUVD-2026-63759

| CVE-2026-77648 LOW
Server-Side Request Forgery (SSRF) (CWE-918)
2026-08-20 mitre GHSA-2jr6-q4j9-8fvp
SSRF Glance
2.2
CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY
2.2 LOW
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
2.2 LOW

Admin-only API (PR:H), filtering bypass adds complexity (AC:H); SSRF yields limited internal read only (C:L), no integrity or availability impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Aug 20, 2026 - 23:23 vuln.today
Patch available
Aug 20, 2026 - 23:04 EUVD

DescriptionCVE.org

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.

AnalysisAI

Server-side request forgery in OpenStack Glance through 32.0.0 allows an authenticated administrator to bypass import_filtering_opts by submitting type=import tasks to the deprecated /v2/tasks API with an internal http:// or https:// URL, causing the Glance service to fetch internal network resources on the admin's behalf. The attack surface is substantially constrained by the PR:H requirement - valid OpenStack admin credentials must already be held - and the affected API has been deprecated for several releases. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain OpenStack admin credentials
Delivery
Submit crafted type=import task to /v2/tasks API
Exploit
Specify internal http/https URL as import source
Execution
Glance service fetches internal endpoint bypassing import_filtering_opts
Impact
Read internal network response data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid OpenStack administrator account - the /v2/tasks API has been restricted to admin-role principals since the Xena release, so standard tenant or member credentials are insufficient. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 2.2 score is accurate and well-calibrated to the actual threat: AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N reflects a network-reachable but tightly gated vulnerability requiring high administrative privileges and high attack complexity, with only limited confidentiality impact and no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained or compromised OpenStack administrator credentials submits a crafted type=import task to the /v2/tasks endpoint, specifying an internal URL - such as the instance metadata service at http://169.254.169.254/latest/meta-data/ or an internal management API - as the import source. Glance's service fetches the URL using its network-layer identity, and the response content becomes accessible to the admin-controlled task context, enabling reconnaissance of internal services. …
Remediation A vendor-released patch is available per OSSN-0105 (https://wiki.openstack.org/wiki/OSSN/OSSN-0105). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Glance

View all
CVE-2022-31546 CRITICAL POC
9.3 Jul 11

The nlpweb/glance repository through 2014-06-27 on GitHub allows absolute path traversal because the Flask send_file fun
CVE-2015-5162 HIGH POC
7.5 Oct 07

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.
CVE-2018-3715 MEDIUM POC
6.5 Jun 07

glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to

CVE-2018-3748 MEDIUM POC
6.1 Jul 03

There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. Rated medium severity (CVSS 6.1), this

CVE-2022-24696 HIGH
7.8 Mar 13

Mirametrix Glance before 5.1.1.42207 (released on 2018-08-30) allows a local attacker to elevate privileges. Rated high

CVE-2013-4428 LOW POC
3.5 Oct 27

OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when t
CVE-2024-32498 MEDIUM
6.5 Jul 05

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Rated medium s
CVE-2017-7200 MEDIUM
5.8 Mar 21

An SSRF issue was discovered in OpenStack Glance before Newton. Rated medium severity (CVSS 5.8), this vulnerability is

CVE-2015-8234 MEDIUM
5.5 Mar 29

The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification pr
CVE-2026-34881 MEDIUM
5.0 Mar 31

Server-Side Request Forgery in OpenStack Glance image import allows authenticated users to bypass URL validation via HTT
CVE-2015-3289 MEDIUM
4.0 Aug 14

OpenStack Glance before 2015.1.1 (kilo) allows remote authenticated users to cause a denial of service (disk consumption
CVE-2013-1840 LOW
3.5 Mar 22

The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 st

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

EUVD-2026-63759 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy