{}

{}

{}

{"acknowledgement": "Upstream acknowledges Cyril Roelandt (Red Hat) as the original reporter.", "bugzilla": {"description": "openstack-glance: openstack-glance: SSRF via location API missing host validation", "id": "2524517", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524517"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A server-side request forgery (SSRF) vulnerability was found in OpenStack Glance. When the HTTP store backend is enabled, an authenticated user can add an image location URL pointing to internal network services. Glance validates only the URL scheme and does not check the host or IP address, allowing the server to make requests to arbitrary internal endpoints. An attacker can read the response by downloading the image, resulting in a full-read SSRF that may expose sensitive data such as cloud metadata credentials."], "mitigation": {"lang": "en:us", "value": "The following measures reduce risk:\n1. If the HTTP store backend is not required, remove it from enabled_backends in glance-api.conf and restart Glance API.\n2. If HTTP store is required, restrict add_image_location to a service-only role (for example add_image_location: rule:service_api).\n3. Deploy egress firewall rules on Glance API nodes to block outbound HTTP to link-local and private ranges (169.254.0.0/16, 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)."}, "name": "CVE-2026-71198", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Affected", "package_name": "openstack-glance", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "openstack-glance", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "openstack-glance", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "openstack-glance", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-09-04T08:44:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71198\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71198\nhttps://bugs.launchpad.net/glance/+bug/2161330\nhttps://redhat.atlassian.net/browse/OSPRH-34480"], "statement": "This vulnerability is rated as Important because an authenticated project member can use the Glance location API as a full-read SSRF proxy to internal HTTP services, including cloud metadata credentials. The attack requires the HTTP store backend to be enabled. It is separate from the web-download SSRF fixed in CVE-2026-34881.\nRed Hat OpenStack Platform (RHOSP) and Red Hat OpenStack Services on OpenShift (RHOSO) deployments that ship Glance with HTTP store enabled are affected. Deployments without an HTTP store backend are not affected through the new POST /locations API. The older PATCH location API additionally requires show_multiple_locations=True, which is off by default.", "threat_severity": "Important"}

{}