~ / search / GHSA-mc26-q38v-83gv

GHSA-mc26-q38v-83gv

OpenStack Glance is affected by Server-Side Request Forgery (SSRF)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-34881

Packages

EcosystemPackageAffectedFixed in
PyPI glance < 29.2.0 29.2.0
PyPI glance >= 30.0.0, < 30.2.0 30.2.0
PyPI glance >= 31.0.0, < 31.1.0 31.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.

References

External links from the advisory. They lead to third-party sites.