CVE-2026-77648: Openstack Glance

Low severity, CVSS 2.2. EPSS: 0.3% chance of exploitation in the next 30 days.

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.

Affected products

• Openstack Glance: from 30.0.0, before 30.3.0 (fixed in 30.3.0); from 31.0.0, before 31.1.1 (fixed in 31.1.1); version 32.0.0 only

Published 2026-08-20. Last modified 2026-09-09.