Skip to content
fr Sign in
2.2 Low

CVE-2026-77648 In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts,…

Description

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.

Affected products and versions

Product Affected versions Fixed in
Glance 32.0.0 No fix stated
Glance 31.0 31.0.0 → < 31.1.1 31.1.1
Glance 30.0 30.0.0 → < 30.3.0 30.3.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Glance

The 3 CVEs of Glance →
CVE-2026-71198 In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location… 7.0 High CVE-2026-34881 OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF) 5.0 Medium
Track this CVE