Aller au contenu
en Se connecter
2.2 Faible

CVE-2026-77648 In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts,…

Description

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.

Produits et versions touchés

Produit Versions touchées Corrigé en
Glance 32.0.0 Pas de correctif indiqué
Glance 31.0 31.0.0 → < 31.1.1 31.1.1
Glance 30.0 30.0.0 → < 30.3.0 30.3.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Glance

Les 3 CVE de Glance →
CVE-2026-71198 In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location… 7.0 Élevée CVE-2026-34881 OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF) 5.0 Moyenne
Suivre cette CVE