CVE-2026-34881

Name of the Vulnerable Software and Affected Versions OpenStack Glance versions prior to 29.1.1 OpenStack Glance versions 30.0.0 through 30.1.0 OpenStack Glance version 31.0.0

Description An authenticated user can exploit a Server-Side Request Forgery (SSRF) flaw within the image import functionality. This issue occurs due to inadequate validation of Uniform Resource Identifiers (URIs), which can be bypassed using HTTP redirects or alternative IP encodings. This allows an attacker to redirect requests to internal services, potentially gaining unauthorized access to internal network resources and exfiltrating sensitive data. The flaw specifically affects the web-download and glance-download import methods, as well as the optional ovf process image import plugin.

Recommendations Update to version 29.1.1 or later. Update to version 30.1.1 or later. Update to a version later than 31.0.0. Restrict the use of the web-download and glance-download import methods. Disable the ovf process image import plugin if it is not required.