# CVE-2013-1840: OpenStack Glance credential leak in v1 API cached image requests

Source: https://junglewise.ai/threats/cve-2013-1840-openstack-glance-credential-leak-in-v1-api-cached-image-requests  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-17. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2013-1840 · Severity: low · CVSS 3.5 · Published 2022-05-17

OpenStack Glance, a service for managing virtual machine images, is vulnerable to a credential leak. When certain storage configurations are used, an authenticated user can retrieve the administrator's backend storage credentials (such as for Amazon S3 or Swift) simply by requesting a cached image. This could allow an attacker to gain unauthorized access to the underlying storage system where all virtual machine images are kept.

Technologies: [glance (PyPI)](https://junglewise.ai/threats/technologies/pypi-glance). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2013-1840 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2013-1840 being exploited in the wild.

**How severe is CVE-2013-1840?** Low severity, with a CVSS score of 3.5, published 17 May 2022.

**Which products and versions are affected?** glance (PyPI) ECOSYSTEM:introduced=0,fixed=11.0.0a0, ECOSYSTEM:introduced=0,last_affected=v1.

**Is there a fix for CVE-2013-1840?** Yes. glance (PyPI): upgrade to 11.0.0a0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2013-1840 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2013-1840?** Check whether you run glance (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- glance (PyPI): upgrade to 11.0.0a0 or later

  ```sh
  pip install "glance>=11.0.0a0"
  ```


## Technical details

An information exposure vulnerability exists in the OpenStack Glance v1 API when configured with single-tenant Swift or S3 storage backends. The vulnerability is rooted in the `_inject_location_header` function within the image serializer, which fails to strip sensitive backend location metadata when serving cached images. A remote authenticated attacker can trigger this by requesting a cached image, causing the server to return the `X-Image-Meta-Location` header containing plaintext credentials for the storage provider. This issue affects Glance versions Essex (2012.1), Folsom (2012.2), and Grizzly. Patches were released to ensure the location field is deleted from the image metadata before the response headers are populated.

## Affected products

- OpenStack Glance Essex (2012.1), Folsom (2012.2), Grizzly

## Identifiers

- CVE-2013-1840
- GHSA-c8w9-83vg-r8vv
- PYSEC-2013-46

## Timeline

- 2013-02-28: disclosed: Bug reported on Launchpad by Stuart McLaren
- 2013-03-22: advisory: NVD published CVE-2013-1840
- 2013-04-04: patched: Red Hat released security update RHSA-2013:0707

## References

- [https://bugs.launchpad.net/glance/+bug/1135541](https://bugs.launchpad.net/glance/+bug/1135541)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/82878](https://exchange.xforce.ibmcloud.com/vulnerabilities/82878)
- [http://osvdb.org/91304](http://osvdb.org/91304)
- [http://rhn.redhat.com/errata/RHSA-2013-0707.html](http://rhn.redhat.com/errata/RHSA-2013-0707.html)
- [http://secunia.com/advisories/52565](http://secunia.com/advisories/52565)

## Related threats

- [PYSEC-2026-2493 - OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access](https://junglewise.ai/threats/cve-2024-32498-openstack-cinder-glance-and-nova-vulnerable-to-arbitrary-file)
- [PYSEC-2026-868 - OpenStack Cinder, glance, and Nova vulnerable to Path Traversal](https://junglewise.ai/threats/cve-2022-47951-openstack-cinder-glance-and-nova-vulnerable-to-path-traversal)
- [PYSEC-2026-817 - OpenStack Image Registry and Delivery Service (Glance) Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2014-0162-openstack-image-registry-and-delivery-service-glance-improper)
- [PYSEC-2026-816 - OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions](https://junglewise.ai/threats/cve-2015-5251-openstack-image-service-glance-allows-remote-authenticated-users)
- [OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service](https://junglewise.ai/threats/cve-2015-5286-openstack-image-service-glance-allows-remote-authenticated-users)