Bug 2440368 (CVE-2026-34881)

Summary: CVE-2026-34881 openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: eglynn, jjoyce, jpretori, jschluet, lhh, mburns, mgarciac, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in OpenStack Glance. An authenticated user can exploit a Server-Side Request Forgery (SSRF) vulnerability within the web-download import feature. This vulnerability stems from inadequate validation of Uniform Resource Identifiers (URIs), which can be circumvented using HTTP redirects or alternative IP encodings. Successful exploitation allows an attacker to gain unauthorized access to internal network resources and potentially exfiltrate sensitive data.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-03-19   

Description OSIDB Bzimport 2026-02-17 14:05:37 UTC 
Server-Side Request Forgery (SSRF) vulnerability in the web-download import workflow of OpenStack Glance. The issue arises because validate_import_uri() validates only the initial URI using string-based hostname comparison, and urllib.request.urlopen() automatically follows HTTP redirects without revalidating the redirect destination. Additionally, alternative IP encodings (decimal, hexadecimal, octal representations) are not normalized prior to blacklist checks, allowing encoded internal IP addresses (e.g., 0x7f000001 for 127.0.0.1) to bypass validation. An authenticated user can supply a crafted URI that either redirects to an internal resource or directly references an encoded internal IP address, resulting in unauthorized internal network access and potential sensitive data exfiltration.
Comment 2 errata-xmlrpc 2026-07-15 09:58:09 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Services on OpenShift 18.0

Via RHSA-2026:39812 https://access.redhat.com/errata/RHSA-2026:39812
Comment 3 errata-xmlrpc 2026-08-13 23:37:58 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.2

Via RHSA-2026:54757 https://access.redhat.com/errata/RHSA-2026:54757