Description (CNA)
In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenStack / Glance | affected 30.0.0 before 30.3.0; affected 31.0.0 before 31.1.1; affected 32.0.0 |
CWE
CWE-918
References
- https://wiki.openstack.org/wiki/OSSN/OSSN-0105
- https://www.openwall.com/lists/oss-security/2026/08/11/7
ADP enrichment
No English description supplied.
No references supplied.