Server-Side Request Forgery (SSRF) vulnerability in the glance-download import workflow of OpenStack Glance. The issue arises because urllib.request.urlopen() automatically follows HTTP redirects in both metadata retrieval and image download steps without validating the redirect destination. Although the initial URL is validated via validate_import_uri() (including IP normalization), redirect targets bypass all validation. An authenticated administrator can supply a crafted Glance endpoint that redirects to internal resources such as 127.0.0.1 or 169.254.169.254, causing the service to access restricted internal endpoints. The response may then be processed or stored as image data, enabling internal data exposure and potential cloud control plane compromise.