EUVD-2026-87085
GHSA-w3cp-w8pp-v434
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege tenant user
-
DeliveryCreate image left in queued state
-
ExploitSend crafted PATCH to locations attribute
-
ExecutionGlance issues server-side request to internal URL
-
ImpactRead internal service/metadata responses
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the show_multiple_locations configuration option to be explicitly enabled in glance-api.conf - this is a non-default, deprecated/discouraged setting, so default OpenStack deployments are NOT exploitable. The attacker must be an authenticated user (PR:L) able to create/own an image and reach the Glance Image API (v2) over the network. The targeted image must be in the 'queued' state, and the attack is performed by manipulating its 'locations' attribute via a crafted HTTP PATCH request. Limiting factors: mandatory non-default configuration, valid tenant credentials, and network access to the Glance API endpoint; these substantially narrow the exposed population despite the network attack vector. |
| Impact | This is a genuine but conditionally-gated priority rather than a drop-everything emergency. The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N) reflects network reach, low complexity, and only low-privilege authentication, with high confidentiality and integrity impact - plausible for an SSRF that can pivot to internal cloud services (metadata endpoints, credentials). However, the real-world signals temper this: EPSS is only 0.31% (21st percentile), the CVE is NOT in CISA KEV, and there is no vendor-confirmed active exploitation, so exploitation status is 'no confirmed active exploitation.' A GitHub repository named directly after this CVE pair (sadandbset/CVE-2026-51772-CVE-2026-51773) is referenced, which strongly suggests publicly available exploit/PoC code exists - this raises practical risk above the low EPSS number, but it is a distinct signal from active exploitation and should not be conflated with it. The single most important limiting factor is that exploitation requires the non-default, deprecated show_multiple_locations option to be enabled in glance-api.conf; deployments left at defaults are not exploitable. CONFLICTS/GAPS: the CPE is 'cpe:2.3:a:n/a:n/a' and EUVD affected versions are 'n/a n/a', so affected Glance versions are NOT established in the provided data and must be confirmed against an OpenStack security advisory (OSSA/OSSN). Net: a real, config-dependent SSRF worth prioritizing for OpenStack operators who enabled multiple locations, but lower urgency for the default-configured majority. |
| Exploit ScenarioDerived | In an OpenStack cloud where an operator has enabled show_multiple_locations in glance-api.conf, an authenticated tenant user with an image in the 'queued' state sends a crafted HTTP PATCH request to the Glance Image API (v2) that manipulates the image's 'locations' attribute to point at an internal URL. Glance then issues a server-side request to that attacker-chosen address, allowing the attacker to reach internal-only services such as the cloud metadata endpoint or other back-end APIs unreachable from the tenant network. A CVE-named public GitHub repository is referenced, indicating exploit/PoC code is likely available; combined with AV:N/AC:L/PR:L this makes exploitation straightforward for any authenticated user once the prerequisite config option is set. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Server-side request forgery in the Image API (v2) of OpenStack Glance allows an authenticated tenant user (CVSS vector PR:L, network reachable) to make the glance-api service issue HTTP requests to attacker-chosen URLs by manipulating the 'locations' attribute of an image that is in the 'queued' state via a crafted PATCH request, potentially exposing internal-only services or cloud metadata (high confidentiality impact, limited integrity impact per the assessed vector). The vulnerability is strictly gated: it only functions when the non-default, deprecated 'show_multiple_locations' option is explicitly enabled in glance-api.conf, so standard OpenStack deployments that leave this setting off are not exploitable, and the attacker must hold valid tenant credentials and network access to the Glance API endpoint. Scoring is 8.1 with a low EPSS of 0.31% (21st percentile); the issue is not confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis, although a GitHub repository referencing this CVE and the companion CVE-2026-51773 has appeared and should be treated as a possible proof-of-concept.
RemediationAI
No vendor-released patch version is specified in the available intelligence, so patch status is not confirmed from the provided data and the authoritative NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-51772) should be monitored for a fixed release. The most effective immediate control is to disable the vulnerable feature: set 'show_multiple_locations = False' (the default) in glance-api.conf and restart the glance-api service - the trade-off is that any workflow relying on multi-store image locations, including location-based image import/copy between backends, will stop working, but the option is already deprecated and discouraged by upstream. Where the option cannot be turned off, restrict exposure by ensuring glance-api is reachable only from trusted control-plane networks and not from untrusted tenants, tighten Glance policy so that image 'locations' updates are limited to trusted admin roles rather than ordinary image owners (this can break legitimate tenant image-import flows), apply egress filtering from Glance hosts to block access to cloud metadata endpoints (169.254.169.254) and internal-only management ranges, and alert on PATCH requests to /v2/images/{id} that include a 'locations' body on images in the queued state, treating such events as attempted exploitation. Because exploitation requires valid tenant credentials, auditing and rotating tenant accounts and reviewing image-owner roles reduces the attack surface, and the referenced GitHub repository should be reviewed to keep detection signatures aligned with any published proof-of-concept.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-51772 is a classic CWE-918 server-side request forgery rooted in OpenStack Glance's multi-location image storage feature. Glance normally stores image data in a single backend, but when 'show_multiple_locations' is enabled in glance-api.conf the API exposes a 'locations' attribute that lets clients describe where an image's data lives across multiple stores; Glance then dereferences those URIs server-side. Because an image in the 'queued' state has no data yet and its location metadata is still mutable, a crafted HTTP PATCH to the Image API (v2) can substitute an arbitrary internal URL (for example a cloud metadata endpoint or an internal admin interface) into that attribute, causing the Glance service - which typically runs with elevated network trust - to fetch it on the attacker's behalf and return or act on the result. The underlying weakness is missing validation/sanitization of user-supplied location URIs plus an over-permissive default trust model for the service's outbound requests; CPE data in the available feeds is unpopulated (cpe:2.3:a:n/a:n/a), so the affected component must be identified from the advisory text rather than normalized CPE matching, and EUVD tracks the issue as EUVD-2026-87085.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Authenticated tenant over network (PR:L, AV:N, AC:L); SSRF chiefly leaks internal responses (C:H) with limited integrity via location manipulation (I:L), no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted HTTP PATCH request
Executive ViewAI
OpenStack Glance Image API v2 contains a high-severity server-side request forgery issue that can let authenticated tenant users cause the service to access attacker-chosen URLs, potentially exposing internal-only services or cloud metadata. The vulnerability is only exploitable when the non-default, deprecated show_multiple_locations option is enabled, so standard deployments are not affected. Leadership should care because organizations using that configuration could leak sensitive cloud infrastructure credentials or internal service data, though no public exploit has been identified and EPSS is low.
Disable show_multiple_locations in glance-api.conf; restrict Glance API access to trusted tenants and networks; implement egress filtering from glance-api nodes to block cloud metadata and internal service endpoints; monitor logs for crafted PATCH requests to the locations attribute on queued images.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB