CVE-2026-51773

High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days.

An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the _retry_request function fails to validate the destination host before attaching sensitive authentication headers.

Published 2026-09-25. Last modified 2026-09-30.