CVE-2024-32498

CVE-2024-32498 affects OpenStack components: Cinder (up to 24.0.0), Glance (up to 28.0.2), and Nova (up to 29.0.3). The issue allows arbitrary file access via a crafted QCOW2 external data reference; an authenticated user can cause the server to return contents of a sensitive file by referencing ...

CVE-2022-47951

CVE-2022-47951 affects OpenStack components (Cinder, Glance, Nova): by supplying a specially crafted VMDK flat image referencing a backing file path, an authenticated user could cause the server to return the contents of that backing file, enabling unauthorized data access. Affected ranges: Cinde...

CVE-2026-34881

The OpenStack Glance image service is vulnerable to Server-Side Request Forgery (SSRF) in versions before 29.1.1 , 30.x before 30.1.1 , and 31.0.0 . The root cause is a URL validation bypass where an authenticated user can use HTTP redirects to reach internal services. This specifically affects t...

CVE-2022-4134

CVE-2022-4134 affects OpenStack Glance. A flaw allows a remote, authenticated attacker to tamper with uploaded images, compromising the integrity of virtual machines created from those images. The available sources describe the vulnerable component as openstack-glance and confirm the impact is im...

CVE-2017-7200

OpenStack Glance before Newton is affected by CVE-2017-7200: an SSRF via the copy_from feature in API v1 lets an attacker create images with a URL like http://localhost:22, enabling masked network port scans and potential internal network enumeration originating from the Glance service. The vulne...

CVE-2016-8611

CVE-2016-8611 affects OpenStack Glance image service (v1/v2) where the /images POST API could saturate the database due to no request limits for authenticated users, enabling possible DoS. Public references in Nessus/Red Hat advisories align with the issue. A later SUSE/CROWBAR-related update (SU...