# CVE-2026-34881: OpenStack Glance SSRF in image import functionality

Source: https://junglewise.ai/threats/cve-2026-34881-openstack-glance-ssrf-in-image-import-functionality  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-34881 · Severity: medium · CVSS 5 · Published 2026-03-31

OpenStack Glance, the image service for the OpenStack cloud platform, is affected by a security flaw in its image import functionality. An authenticated user can bypass security checks to force the server to make requests to internal network services that should be inaccessible. This could allow an attacker to probe internal infrastructure or access sensitive data within the private corporate network.

Technologies: [glance (PyPI)](https://junglewise.ai/threats/technologies/pypi-glance). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-34881 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34881 being exploited in the wild.

**How severe is CVE-2026-34881?** Medium severity, with a CVSS score of 5, published 31 March 2026.

**Which products and versions are affected?** glance (PyPI) ECOSYSTEM:introduced=0,fixed=29.2.0, ECOSYSTEM:introduced=0,fixed=29.2.0,introduced=30.0.0,fixed=30.2.0,introduced=31.0.0,fixed=31.1.0.

**Is there a fix for CVE-2026-34881?** Yes. glance (PyPI): upgrade to 29.2.0, 31.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34881 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-34881?** Check whether you run glance (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- glance (PyPI): upgrade to 29.2.0, 31.1.0 or later

  ```sh
  pip install "glance>=31.1.0"
  ```


## Technical details

OpenStack Glance is vulnerable to Server-Side Request Forgery (SSRF) within the 'web-download', 'glance-download', and 'ovf_process' image import methods. The vulnerability stems from three primary issues: the failure of 'urllib.request.urlopen()' to re-validate destinations after HTTP redirects, a lack of IP address normalization (allowing bypasses via hex, octal, or decimal encodings), and a total lack of URI validation in the optional OVF processing plugin. An authenticated attacker can provide a crafted URL that passes initial validation but redirects to internal services or uses encoded IP formats to bypass blacklists. This allows unauthorized access to internal network resources and potential data exfiltration. Patches are available in Glance versions 29.1.1, 30.1.1, and 32.0.0.0rc2.

## Affected products

- OpenStack Glance < 29.1.1, 30.x < 30.1.1, 31.0.0
- Red Hat Red Hat OpenStack Platform 16.2, 17.1, 18.0

## Identifiers

- CVE-2026-34881
- GHSA-mc26-q38v-83gv
- PYSEC-2026-2492

## Timeline

- 2026-02-16: other: CVE request filed with MITRE
- 2026-03-19: advisory: Original OSSA-2026-004 advisory published
- 2026-03-31: disclosed: CVE-2026-34881 assigned and published

## References

- [https://bugs.launchpad.net/glance/+bug/2138602](https://bugs.launchpad.net/glance/+bug/2138602)
- [https://security.openstack.org/ossa/OSSA-2026-004.html](https://security.openstack.org/ossa/OSSA-2026-004.html)
- [https://access.redhat.com/security/cve/CVE-2026-34881](https://access.redhat.com/security/cve/CVE-2026-34881)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2440368](https://bugzilla.redhat.com/show_bug.cgi?id=2440368)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34881.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34881.json)

## Related threats

- [PYSEC-2026-2493 - OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access](https://junglewise.ai/threats/cve-2024-32498-openstack-cinder-glance-and-nova-vulnerable-to-arbitrary-file)
- [PYSEC-2026-868 - OpenStack Cinder, glance, and Nova vulnerable to Path Traversal](https://junglewise.ai/threats/cve-2022-47951-openstack-cinder-glance-and-nova-vulnerable-to-path-traversal)
- [PYSEC-2026-817 - OpenStack Image Registry and Delivery Service (Glance) Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2014-0162-openstack-image-registry-and-delivery-service-glance-improper)
- [PYSEC-2026-816 - OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions](https://junglewise.ai/threats/cve-2015-5251-openstack-image-service-glance-allows-remote-authenticated-users)
- [OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service](https://junglewise.ai/threats/cve-2015-5286-openstack-image-service-glance-allows-remote-authenticated-users)