CVE-2026-71198
Description
In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254), and retrieve the response by downloading the image data. This affects both the new POST /v2/images/{id}/locations API and the old PATCH API when show_multiple_locations is enabled. Deployments with the HTTP store backend enabled are affected.
How to fix
- OpenStack Glance30.2.1, 31.1.1, 32.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenStack Glance | 16.0.0 ≤ v < 30.2.1, 31.0.0 ≤ v < 31.1.1, 32.0.0 ≤ v < 32.0.1 | 30.2.1, 31.1.1, 32.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.