CVE-2026-71198

🗓️ 14 Sep 2026 06:54:21Reported by mitreType

cve🔗 web.nvd.nist.gov👁 33 Views🌐 WEB

OpenStack Glance before 32.0.1 allows SSRF to internal endpoints via the location API.

Reporter	Title	Published	Views	Family All 12
Cvelist	CVE-2026-71198	14 Sep 202606:54	–	cvelist
Debian CVE	CVE-2026-71198	14 Sep 202606:54	–	debiancve
EUVD	EUVD-2026-77315	14 Sep 202606:54	–	euvd
NVD	CVE-2026-71198	14 Sep 202607:17	–	nvd
OSV	DEBIAN-CVE-2026-71198	14 Sep 202607:17	–	osv
OSV	UBUNTU-CVE-2026-71198	14 Sep 202607:17	–	osv
Positive Technologies	PT-2026-91015	3 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-71198: Server-Side Request Forgery (SSRF)	14 Sep 202600:00	–	rapid7
RedhatCVE	CVE-2026-71198	4 Sep 202609:05	–	redhatcve
UbuntuCve	CVE-2026-71198	14 Sep 202607:17	–	ubuntucve

Vulners

CNA

Node

openstack glanceRange16.0.0–30.2.1

openstack glanceRange31.0.0–31.1.1

openstack glanceRange32.0.0–32.0.1

[
  {
    "defaultStatus": "unaffected",
    "product": "Glance",
    "repo": "https://opendev.org/openstack/glance",
    "vendor": "OpenStack",
    "versions": [
      {
        "lessThan": "30.2.1",
        "status": "affected",
        "version": "16.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "31.1.1",
        "status": "affected",
        "version": "31.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "32.0.1",
        "status": "affected",
        "version": "32.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
security	www.security.openstack.org/ossa/OSSA-2026-038.html
openwall	www.openwall.com/lists/oss-security/2026/09/03/2
launchpad	www.launchpad.net/bugs/2161330

Parameter	Position	Path	Description	CWE
url	request body	/v2/images/{id}/locations	OpenStack Glance location API accepts HTTP URLs for image locations without validating the destination host, allowing an authenticated user to point to internal endpoints (e.g., 169.254.169.254) and retrieve image data.	CWE-918

22 Sep 2026 19:56Current

5.7Medium risk

Vulners AI Score5.7

CVSS 47

EPSS0.0045

SSVC

CWE-918