CVE-2026-77648

A flaw was found in OpenStack Glance. A privileged administrator could exploit a vulnerability in the /v2/tasks API by crafting a specific import task. This action bypasses security filtering, enabling the administrator to perform Server-Side Request Forgery SSRF. As a result, an attacker could...

EUVD-2026-63759

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

Linux Distros Unpatched Vulnerability : CVE-2026-77648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from t...

DEBIAN-CVE-2026-77648

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

CVE-2026-77648

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

CVE-2026-77648

CVE-2026-77648 is a Server-Side Request Forgery (SSRF) vulnerability in OpenStack Glance through version 32.0.0. The /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing a privileged administrator to fetch internal URLs from the Glance service network using http:// ...

CVE-2026-77648

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

PT-2026-79269

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import filtering opts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and ...

GHSA-F2FF-P2WW-7P4P vulnerabilities

Vulnerabilities for packages: airflow-core, openstack-glance-2025.1-fips, authentik, label-studio, openstack-nova-2025.2, airflow-postgres-fips, openstack-horizon-2026.1-fips, openstack-placement-2025.2-fips, openstack-placement-2025.1-fips, openstack-keystone-2025.2,...

openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access

A flaw was found in OpenStack Glance. An authenticated user can exploit a Server-Side Request Forgery SSRF vulnerability within the web-download import feature. This vulnerability stems from inadequate validation of Uniform Resource Identifiers URIs, which can be circumvented using HTTP redirects...

GHSA-J5G9-F88F-GFJ3 vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.1-fips, authentik, openstack-placement-2026.1, openstack-nova-2025.2, apache-beam-python-3.12-sdk, openstack-nova-2026.1, openstack-horizon-2026.1-fips, openstack-placement-2025.2-fips, apache-beam-python-3.11-sdk, openstack-placement-2025.1-fip...

CVE-2026-59939 vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.1-fips, authentik, openstack-placement-2026.1, openstack-nova-2025.2, apache-beam-python-3.12-sdk, openstack-nova-2026.1, openstack-horizon-2026.1-fips, openstack-placement-2025.2-fips, apache-beam-python-3.11-sdk, openstack-placement-2025.1-fip...

CVE-2026-59890 vulnerabilities

Vulnerabilities for packages: wazuh-manager-fips, py3-pipenv, openstack-glance-2025.1-fips, authentik, vast-csi, dbt-bigquery, label-studio, openstack-placement-2026.1, spamcheck, openstack-horizon-2026.1-fips, azure-functions-python-worker, pypy-3.10, openstack-placement-2025.2-fips, httpie,...

GHSA-H35F-9H28-MQ5C vulnerabilities

Vulnerabilities for packages: wazuh-manager-fips, py3-pipenv, openstack-glance-2025.1-fips, authentik, vast-csi, dbt-bigquery, label-studio, openstack-placement-2026.1, spamcheck, openstack-horizon-2026.1-fips, azure-functions-python-worker, pypy-3.10, openstack-placement-2025.2-fips, httpie,...

RHSA-2026:39812 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-glance) security update

Bulletin has no description...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-glance) security update

An update for openstack-glance is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

PYSEC-2026-2490 OpenStack Cinder, glance, and Nova vulnerable to Path Traversal

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, a...

OpenStack Image Registry and Delivery Service (Glance) Improper Input Validation vulnerability

The Sheepdog backend in OpenStack Image Registry and Delivery Service Glance 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location...

OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service

OpenStack Image Service Glance before 2014.2.4 juno and 2015.1.x before 2015.1.2 kilo allows remote authenticated users to bypass the storage quota and cause a denial of service disk consumption by deleting images that are being uploaded using a token that expires during the process. NOTE: this...

PYSEC-2026-813 OpenStack Glance Bypass the storage quota and Denial of service

OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service disk consumption by deleting an image in the saving state...