CVE catalog

CVE-2026-71196

glance: CVE-2026-71196

Severity: High · CVSS 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Published: Sep 3, 2026, 8:47:23 PM UTC
Source: [NVD] · [CVE record]

A server-side request forgery (SSRF) vulnerability was found in OpenStack Glance. The web-download image import method allows authenticated users to provide a URI from which the Glance service fetches data. Due to insufficient default host filtering, an attacker with standard tenant credentials can make Glance issue HTTP requests to arbitrary internal network hosts, including the cloud metadata service. The fetched response is stored as image data and can be downloaded by the attacker, enabling exfiltration of sensitive internal data such as cloud instance credentials. openstack-glance: openstack-glance: SSRF via web-download import due to empty default host filters This vulnerability is rated as Important because an authenticated tenant with the standard member role can use Glance as a full-read SSRF proxy to internal HTTP services, including cloud metadata credentials. No administrative role is required. The web-download import method is enabled by default. Red Hat OpenStack Services on OpenShift (RHOSO) and Red Hat OpenStack Platform (RHOSP) deployments that ship OpenStack Glance with web-download enabled are affected. Deployments that have removed web-download from enabled_import_methods, or that have explicitly configured disallowed_hosts to block internal IP ranges, are not affected by the default-config path. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	glance	sid	`2:33.0.0-6`	fixed
Debian	glance	trixie	`2:30.0.0-3+deb13u2`	vulnerable
Debian	glance	bookworm	`2:25.1.0-2+deb12u3`	vulnerable
Debian	glance	bookworm-security	`2:25.1.0-2+deb12u5`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	glance	source	sid	`2:32.0.0-4`	not yet assigned	Not reported	[1146594]
Debian	glance	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1146594]
Debian	glance	source	bookworm	`2:25.1.0-2+deb12u5`	not yet assigned	Not reported	[1146594]

[Debian bug #1146594]

Notes

[trixie] glance: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[glance]Affected
Details (4)
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
[glance-api]Affected
Source package: [glance]
Details (4)
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
[glance-common]Affected
Source package: [glance]
Details (4)
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
[glance-doc]Affected
Source package: [glance]
Details (4)
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
[python3-glance]Affected
Source package: [glance]
Details (4)
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12

[Debian 13 (Trixie)]

[glance]Affected
Details (2)
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
[glance-api]Affected
Source package: [glance]
Details (2)
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
[glance-common]Affected
Source package: [glance]
Details (2)
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
[glance-doc]Affected
Source package: [glance]
Details (2)
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
[python3-glance]Affected
Source package: [glance]
Details (2)
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13

Observed: Oct 26, 2026, 7:12:06 PM UTC

References

[Debian Security Tracker] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]