CVE-2026-77648: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-77648 is a Server-Side Request Forgery (SSRF) vulnerability in OpenStack Glance affecting the deprecated /v2/tasks API. The flaw allows authenticated administrators to submit type=import tasks that bypass import_filtering_opts URI filtering controls, enabling them to fetch internal URLs accessible from the Glance service network using http:// or https:// schemes. Affected versions are Glance 30.0.0–30.3.0, 31.0.0–31.1.1, and 32.0.0; the API has been admin-only since the Xena release and has been deprecated for several releases. It carries a CVSS v3.1 base score of 2.2 (Low) (GitHub Advisory, oss-security).

The root cause is classified as CWE-918 (Server-Side Request Forgery). The legacy tasks import path in Glance uses a permissive URI validator that only checks for http:// or https:// prefixes, without enforcing the host and port restrictions applied by the modern web-download import mechanism (import_filtering_opts). An authenticated admin can craft a POST request to /v2/tasks with type=import and a target internal URL, causing the Glance service to fetch that URL from within its service network. Exploitation requires high privileges (admin role) and is rated high complexity, limiting the practical attack surface (oss-security, GitHub Advisory).

Successful exploitation allows an admin-level attacker to probe and read data from internal network services reachable by the Glance service host — services that would otherwise be inaccessible from external networks. The impact is limited to confidentiality (low), with no integrity or availability consequences. This could expose sensitive metadata, credentials, or internal API responses from services such as OpenStack internal endpoints or cloud metadata services (oss-security, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained by the requirement for admin-level credentials and high attack complexity, significantly reducing the likelihood of opportunistic abuse (GitHub Advisory, oss-security).

1. Obtain admin credentials: The attacker must already possess valid OpenStack admin-level credentials for the target environment.
2. Identify a vulnerable Glance instance: Confirm the Glance version is in the affected range (30.0.0–<30.3.0, 31.0.0–<31.1.1, or 32.0.0) and that the /v2/tasks API is accessible.
3. Craft a malicious import task: Submit a POST request to /v2/tasks with Content-Type: application/json and a body such as {"type": "import", "input": {"import_from": "http://169.254.169.254/latest/meta-data/", "import_from_format": "raw", "image_properties": {}}}, targeting an internal URL of interest (e.g., cloud metadata endpoint or internal OpenStack API).
4. Retrieve the response: Monitor the task status via the Glance API or logs to observe whether the internal URL was fetched and any returned data is accessible.
5. Pivot using exposed data: Use any sensitive information retrieved (tokens, credentials, internal service addresses) for further lateral movement within the OpenStack environment (oss-security).

• Logs: Glance API logs showing POST requests to /v2/tasks with type=import and unusual or internal import_from URLs (e.g., RFC 1918 addresses, 169.254.169.254, or internal OpenStack service endpoints).
• Network: Outbound HTTP/HTTPS connections from the Glance service host to internal network addresses or cloud metadata services not associated with normal image import operations.
• Logs: Glance task records in the database with type=import and import_from values pointing to internal infrastructure rather than external image repositories.

Upgrade OpenStack Glance to a fixed version: 30.3.0 or later (for the 30.x branch), 31.1.1 or later (for the 31.x branch), or a version beyond 32.0.0 once available. Patches have been submitted for review across multiple release branches: 2026.2/hibiscus, 2026.1/gazpacho, 2025.2/flamingo, and 2025.1/epoxy. As an immediate workaround, disable the legacy tasks API via OpenStack policy configuration if it is not actively used in your environment (oss-security, OSSN-0105).

The vulnerability was disclosed by Goutham Pacha Ravi (Red Hat) via the OpenStack Security SIG and the oss-security mailing list on August 11, 2026, with credit to Tim Shephard of roiai.ca for discovery. Red Hat tracked the issue via Bugzilla (Bug 2520853) with a low severity rating. No significant broader media coverage or notable community controversy has been observed, consistent with the low CVSS score and admin-only exploitation requirement (oss-security, Red Hat Bugzilla).