Executive brief
OpenStack Glance is an image storage and management service used in cloud deployments. When the HTTP store backend is enabled, authenticated users can add arbitrary HTTP URLs as image locations without validation of the destination host. An attacker can point these locations to internal cloud services (such as metadata endpoints at 169.254.169.254 or localhost services) and retrieve the response as image data, enabling full read access to internal endpoints that should not be exposed. This converts a blind SSRF into a data exfiltration vulnerability.
Technical details
This is a server-side request forgery (SSRF) vulnerability in the HTTP location API (POST /v2/images/{id}/locations and PATCH endpoints). The root cause is that the location API only validates the URL scheme (http/https allowed, file:// blocked) but does not apply host filtering restrictions present in the web-download import path (import_filtering_opts). An authenticated user can add a location pointing to internal addresses like 127.0.0.1, localhost, or link-local addresses (169.254.169.254). When Glance downloads or hashes the image, it makes an HTTP request from the glance-api server to the attacker-specified URL, and the response becomes the image file content. The attacker can then download the image via GET /v2/images/{id}/file to exfiltrate the response. Affected versions: Glance >=16.0.0 <30.2.1, >=31.0.0 <31.1.1, >=32.0.0 <32.0.1. Patches are available in the referenced OpenStack review commits.
Affected products
- OpenStack Glance 16.0.0 through 30.2.0, 31.0.0 through 31.1.0, 32.0.0 (fixed in 32.0.1)
Timeline
- 2026-09-03: disclosed: OSSA-2026-038 security advisory published
- 2026-09-03: patched: Patches available for multiple OpenStack releases via review.opendev.org