CVE-2026-71197

{}

{}

{}

{"acknowledgement": "Upstream acknowledges Cyril Roelandt (Red Hat) as the original reporter.", "bugzilla": {"description": "openstack-glance: openstack-glance: SSRF blocklist bypass via hostname-to-IP resolution gap in web-download", "id": "2524518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524518"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in OpenStack Glance. The web-download image import method can bypass host-based blocklist filtering. When an operator configures disallowed_hosts with IP addresses to block access to internal services, an attacker can circumvent this protection by using a hostname that resolves to the blocked IP address. The hostname-to-IP resolution result is not used for blocklist comparison, allowing an authenticated user to force the Glance server to make requests to internal network services that were intended to be blocked."], "mitigation": {"lang": "en:us", "value": "The following measures reduce risk:\n1. Remove web-download from enabled_import_methods in glance-api.conf if the method is not required:\nenabled_import_methods = glance-direct, copy-image\n2. If web-download is required, use allowed_hosts (allowlist of trusted source hostnames) instead of disallowed_hosts. This prevents attacker-controlled domains from being accepted. It does not fully address DNS rebinding between validation and fetch."}, "name": "CVE-2026-71197", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "openstack-glance", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "openstack-glance", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "openstack-glance", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "openstack-glance", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-09-04T08:36:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71197\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71197\nhttps://bugs.launchpad.net/glance/+bug/2158999\nhttps://redhat.atlassian.net/browse/OSPRH-32931"], "statement": "This vulnerability is rated as Moderate because it requires an authenticated OpenStack user with image import permissions, and it is a bypass of an optional IP blocklist rather than a default-open SSRF. Default disallowed_hosts is empty, so this specific bypass only matters on deployments that already configured host filtering.\nRed Hat OpenStack Services on OpenShift (RHOSO) and Red Hat OpenStack Platform (RHOSP) deployments that ship Glance with web-download enabled are in scope. Deployments that do not use web-download are not affected by this bypass.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "glance", "vendor": "openstack"}], "created": "2026-09-04T13:30:05.292337+00:00", "updated": "2026-09-04T14:00:05.843615+00:00", "vendors": ["openstack", "openstack$PRODUCT$glance"]}