PT-2026-29197 · Openstack+2 · Openstack Glance+3

Hyeongeun_Ji · Publicado 2026-03-31 · Atualizado 2026-04-22 · CVE-2026-34881

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Glance versions prior to 29.1.1 OpenStack Glance versions 30.0.0 through 30.1.1 OpenStack Glance version 31.0.0

Description An authenticated user can bypass URL validation checks and redirect to internal services through HTTP redirects, leading to Server-Side Request Forgery (SSRF). The web-download and glance-download image import methods, as well as the ovf process image import plugin (when enabled), are affected.

Recommendations Update to a version of OpenStack Glance greater than or equal to 29.1.1. Update to a version of OpenStack Glance greater than or equal to 30.1.1. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-34881

GHSA-MC26-Q38V-83GV

USN-8199-1

Produtos afetados

Linuxmint

Openstack Glance

Ubuntu

Ovf Process

Referências · 15

• 🔥 https://bugs.launchpad.net/glance/+bug/2138602 · Exploit
• https://github.com/openstack/glance · Nota
• https://cve.org/CVERecord?id=CVE-2026-34881 · Nota de Segurança
• https://security.openstack.org/ossa/OSSA-2026-004.html · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-8199-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-34881 · Nota de Segurança
• https://osv.dev/vulnerability/USN-8199-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mc26-q38v-83gv · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2024-32498 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2026/03/19/3 · Nota
• https://security-tracker.debian.org/tracker/CVE-2026-34881 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2038916024851112188 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34881 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34881 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-34881 · Aviso do Fabricante