CVE catalog

CVE-2026-71197

glance: CVE-2026-71197

Severity: Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published: Sep 3, 2026, 8:47:26 PM UTC
Source: [NVD] · [CVE record]

A flaw was found in OpenStack Glance. The web-download image import method can bypass host-based blocklist filtering. When an operator configures disallowed_hosts with IP addresses to block access to internal services, an attacker can circumvent this protection by using a hostname that resolves to the blocked IP address. The hostname-to-IP resolution result is not used for blocklist comparison, allowing an authenticated user to force the Glance server to make requests to internal network services that were intended to be blocked. openstack-glance: openstack-glance: SSRF blocklist bypass via hostname-to-IP resolution gap in web-download This vulnerability is rated as Moderate because it requires an authenticated OpenStack user with image import permissions, and it is a bypass of an optional IP blocklist rather than a default-open SSRF. Default disallowed_hosts is empty, so this specific bypass only matters on deployments that already configured host filtering. Red Hat OpenStack Services on OpenShift (RHOSO) and Red Hat OpenStack Platform (RHOSP) deployments that ship Glance with web-download enabled are in scope. Deployments that do not use web-download are not affected by this bypass. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	glance	sid	`2:33.0.0-6`	fixed
Debian	glance	trixie	`2:30.0.0-3+deb13u2`	vulnerable
Debian	glance	bookworm	`2:25.1.0-2+deb12u3`	vulnerable
Debian	glance	bookworm-security	`2:25.1.0-2+deb12u5`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	glance	source	sid	`2:32.0.0-4`	not yet assigned	Not reported	[1146594]
Debian	glance	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1146594]
Debian	glance	source	bookworm	`2:25.1.0-2+deb12u5`	not yet assigned	Not reported	[1146594]

[Debian bug #1146594]

Notes

[trixie] glance: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[glance]Affected
Details (4)
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
[glance-api]Affected
Source package: [glance]
Details (4)
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
[glance-common]Affected
Source package: [glance]
Details (4)
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
[glance-doc]Affected
Source package: [glance]
Details (4)
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
[python3-glance]Affected
Source package: [glance]
Details (4)
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u3 · all · bookworm
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12
- 2:25.1.0-2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2:25.1.0-2+deb12u5
  dsa · glance · debian · bookworm; dsa · glance · debian · 12

[Debian 13 (Trixie)]

[glance]Affected
Details (2)
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
[glance-api]Affected
Source package: [glance]
Details (2)
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
[glance-common]Affected
Source package: [glance]
Details (2)
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
[glance-doc]Affected
Source package: [glance]
Details (2)
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
[python3-glance]Affected
Source package: [glance]
Details (2)
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13
- 2:30.0.0-3+deb13u2 · all · trixie
  Affected
  dsa · glance · debian · 13

Observed: Oct 26, 2026, 7:12:06 PM UTC

References

[Debian Security Tracker] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]