CVE-2026-34881

CWE-918 — Server-Side Request Forgery (SSRF)10 documents8 sources
Severity
5.0MEDIUM
EPSS
0.0%
top 91.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Openstack Glance
Timeline
PublishedMar 31

Description

OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:NExploitability: 3.1 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5openstack/glance30.0.0 — 30.1.1+2
▶PyPIglance30.0.0 — 30.2.0+2
▶Debianglance< 2:31.0.0-3

🔴Vulnerability Details

5
OSV
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)↗2026-03-31
▶
OSV
CVE-2026-34881: OpenStack Glance =30↗2026-03-31
▶
OSV
CVE-2026-34881: OpenStack Glance before 29↗2026-03-31
▶
CVEList
CVE-2026-34881: OpenStack Glance before 29↗2026-03-31
▶
GHSA
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)↗2026-03-31
▶

📋Vendor Advisories

2
Red Hat
OpenStack Glance: OpenStack Glance: Server-Side Request Forgery via HTTP redirects in image import↗2026-03-31
▶
Debian
CVE-2026-34881: glance - OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Se...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-34881 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

1
Bugzilla
CVE-2026-34881 OpenStack Glance: OpenStack Glance: Server-Side Request Forgery via HTTP redirects in image import↗2026-03-31
▶
CVE-2026-34881 (MEDIUM CVSS 5) | OpenStack Glance before 29.1.1 | cvebase.io