GitHub Advisoryadvisory · PyPI

GHSA-mc26-q38v-83gv OpenStack Glance is affected by Server-Side Request Forgery (SSRF)

MEDIUM Published 2026-03-31 Modified 2026-04-01 Official page ↗
Aliases
CVE-2026-34881
Ecosystem
PyPI
Packages
glance
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Weaknesses
CWE-918
Reviewed
2026-04-01

Affected packages

• PyPI glance: < 29.2.0 → fixed in 29.2.0 • PyPI glance: >= 30.0.0, < 30.2.0 → fixed in 30.2.0 • PyPI glance: >= 31.0.0, < 31.1.0 → fixed in 31.1.0

Description

OpenStack Glance versions = 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.

Related

Alias · CVE (1)

  • CVE-2026-34881 OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References