01 Record

CVE-2026-77648

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF),

LowPUBLISHEDCNA: mitre

Base score2.2 CVSS v3.xCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

View raw JSON CVE Program record

02 Description

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF),

03 Metadata

Published

2026-08-20 22:37Z1 DAY AGO

Last updated

2026-08-20 22:37Z1 DAY AGO

Reserved

2026-08-20

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Low (CVSS 2.2)

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-918Server-Side Request Forgery (SSRF)Base

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

9e4b6fcf87cb7a0ab2f5250bab71d77301839704660e99a5d23e7ff45b6556ba

04 Affected products

VendorProductVersionsPlatforms

OpenStackGlance30.0.0 to < 30.3.0, 31.0.0 to < 31.1.1, 32.0.0—

05 References

wiki.openstack.orghttps://wiki.openstack.org/wiki/OSSN/OSSN-0105
www.openwall.comhttps://www.openwall.com/lists/oss-security/2026/08/11/7

01 Record