CVE-2026-34881

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2026-34881", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-03-31T05:29:07.975Z", "datePublished": "2026-03-31T05:29:08.449Z", "dateUpdated": "2026-08-14T12:04:37.797Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Glance", "vendor": "OpenStack", "versions": [{"lessThan": "29.1.1", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "30.1.1", "status": "affected", "version": "30.0.0", "versionType": "semver"}, {"status": "affected", "version": "31.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-02T18:20:21.022Z"}, "references": [{"url": "https://bugs.launchpad.net/glance/+bug/2138602"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-004.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*", "versionEndExcluding": "29.1.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*", "versionStartIncluding": "30.0.0", "versionEndExcluding": "30.1.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*", "versionStartIncluding": "31.0.0", "versionEndIncluding": "31.0.0"}]}]}]}, "adp": [{"references": [{"url": "https://bugs.launchpad.net/glance/+bug/2138602", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T13:47:30.640583Z", "id": "CVE-2026-34881", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T13:47:36.130Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:18.0::el9"], "defaultStatus": "affected", "packageName": "openstack-glance", "product": "Red Hat OpenStack Services on OpenShift 18.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1:26.1.1-18.0.20260422134725.c2ac316.el9ost", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:16.2"], "defaultStatus": "affected", "packageName": "openstack-glance", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "affected", "packageName": "openstack-glance", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}], "datePublic": "2026-03-25T20:00:00.000Z", "descriptions": [{"lang": "en", "value": "A flaw was found in OpenStack Glance. An authenticated user can exploit a Server-Side Request Forgery (SSRF) vulnerability within the web-download import feature. This vulnerability stems from inadequate validation of Uniform Resource Identifiers (URIs), which can be circumvented using HTTP redirects or alternative IP encodings. Successful exploitation allows an attacker to gain unauthorized access to internal network resources and potentially exfiltrate sensitive data."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-34881"}, {"name": "RHBZ#2440368", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440368"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34881.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:54757"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:39812"}], "solutions": [{"lang": "en", "value": "RHSA-2026:54757: Red Hat OpenStack Platform 16.2"}, {"lang": "en", "value": "RHSA-2026:39812: Red Hat OpenStack Services on OpenShift 18.0"}], "timeline": [{"lang": "en", "time": "2026-02-17T13:36:28.695Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-25T20:00:00.000Z", "value": "Made public."}], "title": "openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-14T12:04:37.797Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:openstack:18.0::el9"], "vendor": "Red Hat", "product": "Red Hat OpenStack Services on OpenShift 18.0", "versions": [{"status": "unaffected", "version": "1:26.1.1-18.0.20260422134725.c2ac316.el9ost", "lessThan": "*", "versionType": "rpm"}], "packageName": "openstack-glance", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:16.2"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.2", "packageName": "openstack-glance", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:17.1"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.1", "packageName": "openstack-glance", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-02-17T13:36:28.695Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-25T20:00:00.000Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:54757: Red Hat OpenStack Platform 16.2"}, {"lang": "en", "value": "RHSA-2026:39812: Red Hat OpenStack Services on OpenShift 18.0"}], "x_adpType": "supplier", "datePublic": "2026-03-25T20:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-34881", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440368", "name": "RHBZ#2440368", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34881.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54757", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:39812", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in OpenStack Glance. An authenticated user can exploit a Server-Side Request Forgery (SSRF) vulnerability within the web-download import feature. This vulnerability stems from inadequate validation of Uniform Resource Identifiers (URIs), which can be circumvented using HTTP redirects or alternative IP encodings. Successful exploitation allows an attacker to gain unauthorized access to internal network resources and potentially exfiltrate sensitive data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-14T12:04:37.797Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34881", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T13:47:30.640583Z"}}}], "references": [{"url": "https://bugs.launchpad.net/glance/+bug/2138602", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T13:47:25.950Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenStack", "product": "Glance", "versions": [{"status": "affected", "version": "0", "lessThan": "29.1.1", "versionType": "semver"}, {"status": "affected", "version": "30.0.0", "lessThan": "30.1.1", "versionType": "semver"}, {"status": "affected", "version": "31.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://bugs.launchpad.net/glance/+bug/2138602"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-004.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "29.1.1"}, {"criteria": "cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "30.1.1", "versionStartIncluding": "30.0.0"}, {"criteria": "cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "31.0.0", "versionStartIncluding": "31.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-02T18:20:21.022Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34881", "state": "PUBLISHED", "dateUpdated": "2026-08-14T12:04:37.797Z", "dateReserved": "2026-03-31T05:29:07.975Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-31T05:29:08.449Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Glance", "vendor": "OpenStack", "versions": [{"lessThan": "29.1.1", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "30.1.1", "status": "affected", "version": "30.0.0", "versionType": "semver"}, {"status": "affected", "version": "31.0.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:18.0::el9"], "defaultStatus": "affected", "packageName": "openstack-glance", "product": "Red Hat OpenStack Services on OpenShift 18.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1:26.1.1-18.0.20260422134725.c2ac316.el9ost", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:16.2"], "defaultStatus": "affected", "packageName": "openstack-glance", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "affected", "packageName": "openstack-glance", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*", "matchCriteriaId": "325D2E1E-9F38-4214-BE62-4D8B009843C9", "versionEndExcluding": "29.1.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*", "matchCriteriaId": "60818EB5-7DE4-47E5-A1B5-62EDDE6B7A86", "versionEndExcluding": "30.1.1", "versionStartIncluding": "30.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:glance:31.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "9E45E722-E69D-4C9D-A6F0-C96AC2335AB2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin."}, {"lang": "es", "value": "OpenStack Glance <29.1.1, >=30.0.0 <30.1.1, ==31.0.0 se ve afectado por Falsificaci\u00f3n de Petici\u00f3n del Lado del Servidor (SSRF). Mediante el uso de redirecciones HTTP, un usuario autenticado puede eludir las comprobaciones de validaci\u00f3n de URL y redirigir a servicios internos. Solo la funcionalidad de importaci\u00f3n de im\u00e1genes de Glance se ve afectada. En particular, los m\u00e9todos de importaci\u00f3n web-download y glance-download est\u00e1n sujetos a esta vulnerabilidad, al igual que el plugin de importaci\u00f3n de im\u00e1genes ovf_process opcional (no habilitado por defecto)."}], "id": "CVE-2026-34881", "lastModified": "2026-08-14T13:18:15.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34881", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-31T13:47:30.640583Z", "version": "2.0.3"}}]}, "published": "2026-03-31T06:16:01.130", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://bugs.launchpad.net/glance/+bug/2138602"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://security.openstack.org/ossa/OSSA-2026-004.html"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:39812"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:54757"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-34881"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://bugs.launchpad.net/glance/+bug/2138602"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440368"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34881.json"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cve@mitre.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-918"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "OpenStack Glance: OpenStack Glance: Server-Side Request Forgery via HTTP redirects in image import", "id": "2453289", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453289"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.", "A flaw was found in OpenStack Glance. An authenticated user can exploit this Server-Side Request Forgery (SSRF) vulnerability by using HTTP redirects to bypass URL validation checks. This allows the user to redirect to internal services. The vulnerability specifically affects the glance image import functionality, including the web-download and glance-download import methods, and the optional ovf_process image import plugin."], "name": "CVE-2026-34881", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "redhat-user-workloads/openstack-glance-api", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "redhat-user-workloads/openstack-glance-base", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "openstack-glance", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/openstack-glance-api", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "openstack-glance", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/openstack-glance-api", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "openstack-glance", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/openstack-glance-api", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-03-31T05:29:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-34881\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34881\nhttps://bugs.launchpad.net/glance/+bug/2138602\nhttps://security.openstack.org/ossa/OSSA-2026-004.html"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,29.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[30.0.0,30.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "31.0.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Glance", "source": "cna", "vendor": "OpenStack"}, "product": "glance", "vendor": "openstack"}], "analysis": {"en": {"generated_at": "2026-04-14T03:52:32.385263+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011supplied patch described in the OpenStack OSSA\u20112026\u2011004 advisory or upgrade Glance to a version equal or newer than 29.1.1, 30.1.1, or 31.0.1.", "If an upgrade is not possible, disable the web\u2011download and glance\u2011download import methods or the ovf_process plugin until a patch can be applied.", "Configure Glance\u2019s outbound network rules to block or whitelist HTTP redirects, preventing the service from reaching internal IP ranges.", "Monitor Glance logs for unexpected redirect attempts and review any traffic that bypasses the usual validation checks."], "summary": {"action": "Patch Now", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "Affected installations are OpenStack Glance versions earlier than 29.1.1, any 30.x release prior to 30.1.1, and the 31.0.0 release. Only the image import pathways\u2014web\u2011download, glance\u2011download, and the optional ovf_process plugin\u2014are susceptible. Users must have authentication and the privilege to initiate image import for exploitation.", "description_and_impact": "This vulnerability is a Server\u2011Side Request Forgery that permits an authenticated user to trigger HTTP redirects during image import. By bypassing normal URL validation, Glance can reach internal network services, potentially exposing private resources or enabling internal reconnaissance. The flaw aligns with CWE\u2011918, and no evidence suggests it leads to remote code execution or denial of service.", "risk_and_exploitability": "The CVSS score is 5, indicating moderate severity, EPSS is below 1\u202f%, showing a low likelihood of exploitation, and it is not listed in the CISA KEV catalog. Based on the description, the attack requires an authenticated user to supply a crafted URL that redirects to an internal endpoint; therefore the likely attack vector is credentialed internal administration. If an attacker directs Glance to an internal service, they may obtain sensitive data or pivot further inside the network."}}}}, "created": "2026-03-31T19:56:11.956160+00:00", "updated": "2026-04-14T16:42:29.439883+00:00", "vendors": ["openstack", "openstack$PRODUCT$glance"]}