CVE-2026-77648
Low
Description
In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.
SeverityLow
CVSS2.2
Exploit probability—
Product
Glance
PublishedAug 20, 2026
First seenAug 20, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- OpenStack Glance30.3.0, 31.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenStack Glance | 30.0.0 ≤ v < 30.3.0, 31.0.0 ≤ v < 31.1.1, 32.0.0 | 30.3.0, 31.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.