Advisory details:
pypa / glance/PYSEC-2026-2492
| Advisory ID | pypa/glance/PYSEC-2026-2492 |
| Aliases |
CVE-2026-34881
GHSA-mc26-q38v-83gv PYSEC-2026-2492 |
| Summary | OpenStack Glance is affected by Server-Side Request Forgery (SSRF) OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 4.5 |
| Risk | 2.2 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 5.0 | https://github.com/pypa/advisory-database/blob/main/vulns/glance/PYSEC-2026-2492.yaml |
| Reference id | Reference type | URL |
|---|---|---|
| https://bugs.launchpad.net/glance/+bug/2138602 | ||
| https://github.com/openstack/glance | ||
| https://pypi.org/project/glance | ||
| https://security.openstack.org/ossa/OSSA-2026-004.html | ||
| CVE-2026-34881 | https://nvd.nist.gov/vuln/detail/CVE-2026-34881 | |
| GHSA-mc26-q38v-83gv | https://github.com/advisories/GHSA-mc26-q38v-83gv |
No exploits are available.
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-31T13:47:30Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/34xxx/CVE-2026-34881.json
Source Advisory: vulnrichment/CVE-2026-34881
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]