Server-Side Request Forgery (SSRF) vulnerability in the OpenShift API server ImageStreamImport mechanism. The flaw is caused by missing IP address and network-range validation when processing user-supplied image references. During an ImageStreamImport request, the API server constructs outbound HTTP requests to retrieve image manifests without validating whether the resolved destination belongs to loopback, link-local, RFC1918 private networks, or cluster service CIDRs. As a result, an authenticated user with image import permissions can trigger network connections to internal services such as the Kubernetes API server, cloud metadata endpoints, or localhost-only services. This behavior enables internal network enumeration, service discovery, limited information disclosure via HTTP responses, and potential denial-of-service through excessive connection attempts.