OpenStack Glance EUVD-2026-63759

Exploitation requires a valid OpenStack administrator account - the /v2/tasks API has been restricted to admin-role principals since the Xena release, so standard tenant or member credentials are insufficient. The attacker must reach the Glance API endpoint over the network (AV:N). The bypass is specific to the type=import task subtype and manifests only because import_filtering_opts is not enforced in this code path; deployments that have disabled or decommissioned the /v2/tasks API entirely are not exposed. The submitted URL must use http:// or https:// scheme; other URI schemes are out of scope. Exploitation yields read-only access to internal HTTP/HTTPS endpoints reachable from the Glance service-layer network - there is no write, code-execution, or availability impact. The deprecation status of the API means operators who have already migrated away from it face no exposure.

The CVSS 2.2 score is accurate and well-calibrated to the actual threat: AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N reflects a network-reachable but tightly gated vulnerability requiring high administrative privileges and high attack complexity, with only limited confidentiality impact and no integrity or availability consequences. No EPSS data was provided in the source intelligence, which limits probabilistic risk comparison; given the PR:H requirement and deprecated API status, exploitation probability is expected to be very low. The absence of both a CISA KEV listing and any public proof-of-concept code further supports treating this as a low-urgency hardening finding. The practical threat model is narrow: the SSRF is only meaningful if a malicious or compromised admin wants to use Glance's service-layer identity to probe internal HTTP/HTTPS endpoints - a scenario that presupposes a prior admin-level compromise, which itself constitutes a far more severe incident. The deprecation trajectory of the /v2/tasks API means exposure will naturally diminish as operators migrate workflows. In summary, this is a genuine configuration hygiene issue with real-but-bounded impact, warranting patching on a normal maintenance schedule rather than emergency response.

An attacker who has obtained or compromised OpenStack administrator credentials submits a crafted type=import task to the /v2/tasks endpoint, specifying an internal URL - such as the instance metadata service at http://169.254.169.254/latest/meta-data/ or an internal management API - as the import source. Glance's service fetches the URL using its network-layer identity, and the response content becomes accessible to the admin-controlled task context, enabling reconnaissance of internal services. No public proof-of-concept code has been identified, though the technique requires only standard Glance API knowledge and admin credentials.