CVE-2026-34881 OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
Authenticated users can bypass URL validation via HTTP redirects in image import to access internal services, requiring an upgrade to OpenStack Glance.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34881?
CVE-2026-34881 is a medium-severity server-side request forgery vulnerability in OpenStack Glance, published on 31 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.
Weakness: CWE-918
Which versions are affected by CVE-2026-34881?
7 open source packages ship an affected version, including glance. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
glance PyPI | All versions | 29.2.0, 30.2.0, 31.1.0 |
glance PyPI | All versions | 29.2.0 |
glance PyPI | All versions | 29.2.0 |
glance PyPI | From 30.0.0 | 30.2.0 |
glance PyPI | From 30.0.0 | 30.2.0 |
glance PyPI | From 31.0.0 | 31.1.0 |
1 more packages
glance PyPI | From 31.0.0 | 31.1.0 |
Linux distribution packages (2)
openstack-glance Red Hat:openstack:18.0::el9 | All versions | 1:26.1.1-18.0.20260422134725.c2ac316.el9ost |
python3-glance Red Hat:openstack:18.0::el9 | All versions | 1:26.1.1-18.0.20260422134725.c2ac316.el9ost |
Products include Openstack Glance.
How do I fix CVE-2026-34881?
Upgrade glance to a fixed version for your release line: 29.2.0, 30.2.0 or 31.1.0.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-34881 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34881 exists.
Other vulnerabilities in OpenStack Glance
- CVE-2017-7200 OpenStack Glance Server-Side Request Forgery (SSRF)
- CVE-2015-8234 OpenStack Glance Signature Verification Bypass
- CVE-2016-8611 Denial of service in openstack-glance
- CVE-2015-3289 Denial of service in n/a
- CVE-2015-5163 OpenStack Image Service (Glance) allows remote authenticated users to read arbitrary file
Sources
Also known as DEBIAN-CVE-2026-34881, GHSA-mc26-q38v-83gv, PYSEC-2026-2492, RHSA-2026:39812, UBUNTU-CVE-2026-34881.