Aller au contenu
en Se connecter
7.0 Élevée

CVE-2026-71198 In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location…

Description

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254), and retrieve the response by downloading the image data. This affects both the new POST /v2/images/{id}/locations API and the old PATCH API when show_multiple_locations is enabled. Deployments with the HTTP store backend enabled are affected.

Produits et versions touchés

Produit Versions touchées Corrigé en
Glance 32.0 32.0.0 → < 32.0.1 32.0.1
Glance 31.0 31.0.0 → < 31.1.1 31.1.1
Glance 16.0 16.0.0 → < 30.2.1 30.2.1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Glance

Les 3 CVE de Glance →
CVE-2026-77648 In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts,… 2.2 Faible CVE-2026-34881 OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF) 5.0 Moyenne
Suivre cette CVE