CVE-2026-77648: SSRF
In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated Glance administrator. The affected /v2/tasks API has been restricted to admins since the Xena release, limiting exposure to environments where admin credentials or access have been compromised.
What does an attacker need to do to trigger the issue?
The attacker must create a type=import task through the /v2/tasks API and provide an http:// or https:// URL. This can cause the Glance service to fetch a URL reachable from its own network, bypassing import_filtering_opts.
Are non-admin users affected by the vulnerable API?
The provided information states that the API has been available only to administrators since Xena. It does not indicate that non-admin users can directly invoke the affected task-import functionality.
What mitigation is available if patching cannot happen immediately?
Restrict access to Glance administrator credentials and the /v2/tasks API, especially task creation for type=import. Since the issue relies on Glance reaching internal HTTP or HTTPS endpoints, limiting the Glance service's network access can also reduce exposure.