{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-71198 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-71198 is a high-severity server-side request forgery vulnerability in OpenStack Glance, published on 14 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-71198 and fix it if it is affected.\n\nWhat it is: CVE-2026-71198 is a high-severity server-side request forgery vulnerability in OpenStack Glance, published on 14 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-71198 in the wild and no public exploit code.\n\nAffected product: OpenStack Glance. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-71198/ (Markdown: https://insights.sbomify.com/CVE-2026-71198/index.md)","id":"CVE-2026-71198","markdown":"https://insights.sbomify.com/CVE-2026-71198/index.md","name":"CVE-2026-71198","record":{"aliases":["DEBIAN-CVE-2026-71198","GHSA-cmxv-7r4v-g73c","UBUNTU-CVE-2026-71198"],"analysis":{"component_type":"cloud_service","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"OpenStack Glance","requires_auth":"low_privilege","summary":"Authenticated users can exploit missing host validation in the location API to access internal endpoints like the metadata service via Server-Side Request Forgery.","user_interaction":"not_required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[],"cvss":{"score":7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"description":"In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254), and retrieve the response by downloading the image data. This affects both the new POST /v2/images/{id}/locations API and the old PATCH API when show_multiple_locations is enabled. Deployments with the HTTP store backend enabled are affected.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Server-side request forgery in Glance","id":"CVE-2026-71198","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"ssrf","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"Missing authorization in Ironic","id":"CVE-2026-71201"},"packages":[],"prev":{"headline":"In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share.","id":"CVE-2026-71195"},"products":["Glance"],"published":"2026-09-14","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-14","vendors":["OpenStack"]},"summary":"Authenticated users can exploit missing host validation in the location API to access internal endpoints like the metadata service via Server-Side Request Forgery.","url":"https://insights.sbomify.com/CVE-2026-71198/"}