Is CVE-2026-34881 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34881 being exploited in the wild.

How severe is CVE-2026-34881?

Medium severity, with a CVSS score of 5, published 31 March 2026.

Which products and versions are affected?

glance (PyPI) ECOSYSTEM:introduced=0,fixed=29.2.0, ECOSYSTEM:introduced=0,fixed=29.2.0,introduced=30.0.0,fixed=30.2.0,introduced=31.0.0,fixed=31.1.0.

Is there a fix for CVE-2026-34881?

Yes. glance (PyPI): upgrade to 29.2.0, 31.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34881 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-34881?

Check whether you run glance (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34881: OpenStack Glance SSRF in image import functionality

CVE-2026-34881 · Severity: medium · CVSS 5 · Published 2026-03-31

OpenStack Glance, the image service for the OpenStack cloud platform, is affected by a security flaw in its image import functionality. An authenticated user can bypass security checks to force the server to make requests to internal network services that should be inaccessible. This could allow an attacker to probe internal infrastructure or access sensitive data within the private corporate network.

Technologies: glance (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-34881 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34881 being exploited in the wild.
How severe is CVE-2026-34881?: Medium severity, with a CVSS score of 5, published 31 March 2026.
Which products and versions are affected?: glance (PyPI) ECOSYSTEM:introduced=0,fixed=29.2.0, ECOSYSTEM:introduced=0,fixed=29.2.0,introduced=30.0.0,fixed=30.2.0,introduced=31.0.0,fixed=31.1.0.
Is there a fix for CVE-2026-34881?: Yes. glance (PyPI): upgrade to 29.2.0, 31.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34881 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-34881?: Check whether you run glance (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

glance (PyPI): upgrade to 29.2.0, 31.1.0 or later
```
pip install "glance>=31.1.0"
```

Technical details

OpenStack Glance is vulnerable to Server-Side Request Forgery (SSRF) within the 'web-download', 'glance-download', and 'ovf_process' image import methods. The vulnerability stems from three primary issues: the failure of 'urllib.request.urlopen()' to re-validate destinations after HTTP redirects, a lack of IP address normalization (allowing bypasses via hex, octal, or decimal encodings), and a total lack of URI validation in the optional OVF processing plugin. An authenticated attacker can provide a crafted URL that passes initial validation but redirects to internal services or uses encoded IP formats to bypass blacklists. This allows unauthorized access to internal network resources and potential data exfiltration. Patches are available in Glance versions 29.1.1, 30.1.1, and 32.0.0.0rc2.

Affected products

OpenStack Glance < 29.1.1, 30.x < 30.1.1, 31.0.0
Red Hat Red Hat OpenStack Platform 16.2, 17.1, 18.0

Identifiers

CVE-2026-34881
GHSA-mc26-q38v-83gv
PYSEC-2026-2492

Timeline

2026-02-16: other: CVE request filed with MITRE
2026-03-19: advisory: Original OSSA-2026-004 advisory published
2026-03-31: disclosed: CVE-2026-34881 assigned and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.