low2.2
CVE-2026-77648
In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs fro…
Impact
In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| OpenStack | OpenStack Glance | through 32.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.