Description
OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenStack | Glance | < 29.1.1, 30.0.0 – < 30.1.1, 31.0.0 | 29.1.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glance | 2:31.0.0-3 | — |
| Debian 13 | glance | 2:30.0.0-3+deb13u1 | — |
| Debian 12 | glance | 2:25.1.0-2+deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | glance | 2:20.2.0-0ubuntu1.2+esm2 | — |
| Ubuntu Pro 18.04 LTS | glance | 2:16.0.1-0ubuntu1.1+esm2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 18 | python3-glance +1 | 1:26.1.1-18.0.20260422134725.c2ac316.el9ost | RHSA-2026:39812 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | glance | < 29.2.0 | 29.2.0 | GHSA-mc26-q38v-83gv |
| PyPI | glance | >= 30.0.0, < 30.2.0 | 30.2.0 | GHSA-mc26-q38v-83gv |
| PyPI | glance | >= 31.0.0, < 31.1.0 | 31.1.0 | GHSA-mc26-q38v-83gv |
| PyPI | glance | < 29.2.0 · >= 30.0.0, < 30.2.0 · >= 31.0.0, < 31.1.0 | 29.2.0, 30.2.0, 31.1.0 | PYSEC-2026-2492 |
Advisories 2
- RHSA-2026:39812 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-glance) security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- WID-SEC-2026-2365 Red Hat OpenShift (OpenStack Services): Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Aug 13, 2026