CVE-2026-34881: SSRF
OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovfprocess image import plugin.
Other sources
Server-Side Request Forgery (SSRF) vulnerability in the web-download import workflow of OpenStack Glance. The issue arises because validateimporturi() validates only the initial URI using string-based hostname comparison, and urllib.request.urlopen() automatically follows HTTP redirects without revalidating the redirect destination. Additionally, alternative IP encodings (decimal, hexadecimal, octal representations) are not normalized prior to blacklist checks, allowing encoded internal IP addresses (e.g., 0x7f000001 for 127.0.0.1) to bypass validation. An authenticated user can supply a crafted URI that either redirects to an internal resource or directly references an encoded internal IP address, resulting in unauthorized internal network access and potential sensitive data exfiltration.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Glanceto a version that resolves this vulnerability.Fixed in 29.1.1 - Upgrade
Upgrade
OpenStack Glanceto a version that resolves this vulnerability.Fixed in 30.1.1 - Upgrade
Upgrade
OpenStack Glanceto a version that resolves this vulnerability.Fixed in 31.0.0 - Configuration
Ensure the optional ovf_process image import plugin is not enabled unless required, since it is listed as subject to the SSRF issue.
OpenStack Glance (ovf_process image import plugin) ovf_process plugin enablement = not enabled by default - Compensating control
Restrict internal network egress/access from the Glance service (e.g., firewall/ACL) so SSRF attempts cannot reach internal services or metadata endpoints.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34881?
CVE-2026-34881 is classified as a high severity vulnerability due to the potential for Server-Side Request Forgery (SSRF) attacks.
How do I fix CVE-2026-34881?
To fix CVE-2026-34881, upgrade OpenStack Glance to versions 29.1.2, 30.1.1, or above 31.0.0.
What versions of OpenStack Glance are affected by CVE-2026-34881?
OpenStack Glance versions less than 29.1.1, between 30.0.0 and 30.1.1, and exactly 31.0.0 are affected by CVE-2026-34881.
What type of vulnerability is CVE-2026-34881?
CVE-2026-34881 is a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated users to bypass URL validation checks.
Which functionality in OpenStack Glance does CVE-2026-34881 impact?
CVE-2026-34881 specifically impacts the image import functionality within OpenStack Glance.