CVE-2026-77648 Server-side request forgery in Glance
An admin can exploit the /v2/tasks API to perform Server-Side Request Forgery, accessing internal URLs from the Glance service network.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77648?
CVE-2026-77648 is a low-severity server-side request forgery vulnerability in OpenStack Glance, published on 20 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.
Weakness: CWE-918
Which versions are affected by CVE-2026-77648?
How do I fix CVE-2026-77648?
Apply the vendor's patch.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-77648 being exploited?
There is no known exploitation of CVE-2026-77648 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-77648, GHSA-2jr6-q4j9-8fvp, UBUNTU-CVE-2026-77648.