p PatchFirst

CVE-2026-71198

CVE-2026-71198

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254), and retrieve the response by downloading the image data. This affects both the new POST /v2/images/{id}/locations API and the old PATCH API when show_multiple_locations is enabled. Deployments with the HTTP store backend enabled are affected.

CVSS 7.0 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • glance

    Versions
    • ≥ 16.0.0, < 30.2.1: Affected (semver)
    • ≥ 31.0.0, < 31.1.1: Affected (semver)
    • ≥ 32.0.0, < 32.0.1: Affected (semver)

    Update to 30.2.1; Update to 31.1.1; Update to 32.0.1

  • glance Debian:12

    Versions
    • 2:25.1.0-2
    • 2:25.1.0-2+deb12u1
    • 2:25.1.0-2+deb12u2
    • 2:25.1.0-2+deb12u3
    Affected ranges
    • ECOSYSTEM: < 2:25.1.0-2+deb12u5

    Update to 2:25.1.0-2+deb12u5

  • glance Debian:13

    Versions
    • 2:30.0.0-3
    • 2:30.0.0-3+deb13u1
    • 2:30.0.0-3+deb13u2
    • 2:31.0.0-1
    • 2:31.0.0-2
    • 2:31.0.0-3
    • 2:31.0.0-4
    • 2:31.0.0~rc1-1
    • 2:31.0.0~rc1-2
    • 2:32.0.0-1
    • 2:32.0.0-2
    • 2:32.0.0-3
    • 2:32.0.0-4
    • 2:32.0.0~rc1-1
    • 2:32.0.0~rc1-2
    • 2:32.0.0~rc1-3
    • 2:32.0.0~rc1-4
    • 2:32.0.0~rc2-1
    • 2:32.0.0~rc2-2
    • 2:33.0.0~rc1-1
    • 2:33.0.0~rc1-2
    • 2:33.0.0~rc1-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glance Debian:14

    Versions
    • 2:30.0.0-3
    • 2:31.0.0-1
    • 2:31.0.0-2
    • 2:31.0.0-3
    • 2:31.0.0-4
    • 2:31.0.0~rc1-1
    • 2:31.0.0~rc1-2
    • 2:32.0.0-1
    • 2:32.0.0-2
    • 2:32.0.0-3
    • 2:32.0.0-4
    • 2:32.0.0~rc1-1
    • 2:32.0.0~rc1-2
    • 2:32.0.0~rc1-3
    • 2:32.0.0~rc1-4
    • 2:32.0.0~rc2-1
    • 2:32.0.0~rc2-2
    • 2:33.0.0~rc1-1
    • 2:33.0.0~rc1-2
    • 2:33.0.0~rc1-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glance Ubuntu:Pro:16.04:LTS

    Versions
    • 2:11.0.0-0ubuntu1
    • 2:12.0.0~b1-0ubuntu1
    • 2:12.0.0~b2-0ubuntu1
    • 2:12.0.0~b3-0ubuntu1
    • 2:12.0.0~rc1-0ubuntu1
    • 2:12.0.0-0ubuntu1
    • 2:12.0.0-0ubuntu2
    • 2:12.0.0-0ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glance Ubuntu:Pro:18.04:LTS

    Versions
    • 2:15.0.0-0ubuntu1
    • 2:16.0.0~b2-0ubuntu2
    • 2:16.0.0~rc1-0ubuntu1
    • 2:16.0.0~rc2-0ubuntu1
    • 2:16.0.0~rc3-0ubuntu1
    • 2:16.0.0-0ubuntu1
    • 2:16.0.1-0ubuntu1.1
    • 2:16.0.1-0ubuntu1.1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glance Ubuntu:Pro:20.04:LTS

    Versions
    • 2:19.0.0-0ubuntu1
    • 2:20.0.0~b1~git2019121610.0c6dd98d-0ubuntu1
    • 2:20.0.0~b2~git2020020509.8649fdc2-0ubuntu1
    • 2:20.0.0~b3~git2020032414.30ece7aa-0ubuntu2
    • 2:20.0.0~b3~git2020041012.d5a0ce18-0ubuntu1
    • 2:20.0.0-0ubuntu0.20.04.1
    • 2:20.0.1-0ubuntu1
    • 2:20.1.0-0ubuntu1
    • 2:20.2.0-0ubuntu1
    • 2:20.2.0-0ubuntu1.1
    • 2:20.2.0-0ubuntu1.2
    • 2:20.2.0-0ubuntu1.2+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glance Ubuntu:22.04:LTS

    Versions
    • 2:23.0.0-0ubuntu1
    • 2:23.0.0+git2021120811.4ee7799aa-0ubuntu1
    • 2:23.0.0+git2022011216.502fa0ffc-0ubuntu1
    • 2:24.0.0~rc1+git2022030311.d4119be05-0ubuntu1
    • 2:24.0.0-0ubuntu1
    • 2:24.1.0-0ubuntu1
    • 2:24.1.0-0ubuntu1.1
    • 2:24.2.0-0ubuntu1
    • 2:24.2.1-0ubuntu1
    • 2:24.2.1-0ubuntu1.2
    • 2:24.2.1-0ubuntu1.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glance Ubuntu:24.04:LTS

    Versions
    • 2:27.0.0-0ubuntu1
    • 2:28.0.0~b2+git2024011916.f429b53e-0ubuntu1
    • 2:28.0.0~rc1-0ubuntu1
    • 2:28.0.1-0ubuntu1
    • 2:28.0.1-0ubuntu1.2
    • 2:28.1.0-0ubuntu1
    • 2:28.1.0-0ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glance Ubuntu:26.10

    Versions
    • 2:32.0.0-0ubuntu1
    • 2:33.0.0~b2-0ubuntu1
    • 2:33.0.0~rc1-0ubuntu1
    • 2:33.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glance Ubuntu:26.04:LTS

    Versions
    • 2:31.0.0-0ubuntu1
    • 2:31.0.0+git2026012615.9f4165f77-0ubuntu1
    • 2:32.0.0~rc1-0ubuntu1
    • 2:32.0.0~rc2-0ubuntu1
    • 2:32.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →