OpenStack Glance is the image service for OpenStack. A Server-Side Request Forgery (SSRF) vulnerability exists in the image location APIs (POST /v2/images/{id}/locations and PATCH /v2/images/{id} with location JSON-patch). When the HTTP store backend is enabled, an authenticated project member can add an image location URL pointing to internal network services (for example http://169.254.169.254/). Glance-api validates only the URL scheme via validate_external_location() in glance/common/store_utils.py (blocking file://, filesystem://, swift+config://) but performs no host, IP, or port filtering.

In contrast, the web-download import path (fixed by OSSA-2026-004 / CVE-2026-34881) correctly calls validate_import_uri() in glance/common/utils.py, which checks allowed/disallowed hosts and ports via import_filtering_opts. The location API code paths bypass this filtering entirely. When a location is added, glance_store makes HTTP HEAD (size check) and GET (hash calculation) requests to the attacker-supplied URL. The response body becomes the image data and can be read via GET /v2/images/{id}/file.

The new POST /locations API requires only the add_image_location policy (SERVICE_OR_PROJECT_MEMBER) and does not require show_multiple_locations. The old PATCH API requires show_multiple_locations=True and the set_image_location policy. Fix is not yet available (coordinating with upstream).

Reporter: Cyril Roelandt (OpenStack Glance PTL, Glance Core Security Team)
Upstream: https://bugs.launchpad.net/glance/+bug/2161330
PSIRT Ticket: PSIRTSUPT-22366
Downstream tracker: OSPRH-34480