CVE-2026-51772

Name of the Vulnerable Software and Affected Versions OpenStack Glance (affected versions not specified)

Description A Server-Side Request Forgery (SSRF) issue exists in the Image API (v2). When the show multiple locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image that is in the queued state by sending a crafted HTTP PATCH request. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable the show multiple locations configuration option in glance-api.conf to mitigate the risk.