CVE-2026-34881

OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://bugs.launchpad.net/glance/+bug/2138602	Exploit Issue Tracking Third Party Advisory
https://security.openstack.org/ossa/OSSA-2026-004.html	Patch Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:39812
https://access.redhat.com/errata/RHSA-2026:54757
https://access.redhat.com/security/cve/CVE-2026-34881
https://bugs.launchpad.net/glance/+bug/2138602	Exploit Issue Tracking Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2440368
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34881.json

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openstack:glance::::::::
	cpe:2.3:a:openstack:glance::::::::
	cpe:2.3:a:openstack:glance:31.0.0:::::::*

History

No history.

Information

Published : 2026-03-31 06:16

Updated : 2026-08-14 13:18

NVD link : CVE-2026-34881

Mitre link : CVE-2026-34881

CVE.ORG link : CVE-2026-34881

JSON object : View

Products Affected

openstack

glance

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-34881", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34881", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T13:47:30.640583Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.1}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "OpenStack", "product": "Glance", "versions": [{"status": "affected", "version": "0", "lessThan": "29.1.1", "versionType": "semver"}, {"status": "affected", "version": "30.0.0", "lessThan": "30.1.1", "versionType": "semver"}, {"status": "affected", "version": "31.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:openstack:18.0::el9"], "vendor": "Red Hat", "product": "Red Hat OpenStack Services on OpenShift 18.0", "versions": [{"status": "unaffected", "version": "1:26.1.1-18.0.20260422134725.c2ac316.el9ost", "lessThan": "*", "versionType": "rpm"}], "packageName": "openstack-glance", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:16.2"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.2", "packageName": "openstack-glance", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:17.1"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.1", "packageName": "openstack-glance", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-03-31T06:16:01.130", "references": [{"url": "https://bugs.launchpad.net/glance/+bug/2138602", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-004.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://access.redhat.com/errata/RHSA-2026:39812", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54757", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-34881", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugs.launchpad.net/glance/+bug/2138602", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440368", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34881.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-918"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin."}, {"lang": "es", "value": "OpenStack Glance <29.1.1, >=30.0.0 <30.1.1, ==31.0.0 se ve afectado por Falsificaci\u00f3n de Petici\u00f3n del Lado del Servidor (SSRF). Mediante el uso de redirecciones HTTP, un usuario autenticado puede eludir las comprobaciones de validaci\u00f3n de URL y redirigir a servicios internos. Solo la funcionalidad de importaci\u00f3n de im\u00e1genes de Glance se ve afectada. En particular, los m\u00e9todos de importaci\u00f3n web-download y glance-download est\u00e1n sujetos a esta vulnerabilidad, al igual que el plugin de importaci\u00f3n de im\u00e1genes ovf_process opcional (no habilitado por defecto)."}], "lastModified": "2026-08-14T13:18:15.247", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "325D2E1E-9F38-4214-BE62-4D8B009843C9", "versionEndExcluding": "29.1.1"}, {"criteria": "cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60818EB5-7DE4-47E5-A1B5-62EDDE6B7A86", "versionEndExcluding": "30.1.1", "versionStartIncluding": "30.0.0"}, {"criteria": "cpe:2.3:a:openstack:glance:31.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E45E722-E69D-4C9D-A6F0-C96AC2335AB2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}