CVE-2026-71198
Quick assessment
Affected
OpenStack Glance
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 OpenStack Glance 32.0.1 之前的版本中，location API 在将 HTTP 位置添加到镜像时，不会校验目标主机。与 web-download 导入路径不同，location API 仅检查 URL 协议，而不会应用 中的主机限制。经过认证的用户可以添加一个指向内部端点（例如云元数据服务 169.254.169.254）的位置，并通过下载镜像数据来获取响应。该问题同时影响新的 API 以及在启用 时的旧版 PATCH API。启用 HTTP 存储后端的部署环境均受此问题影响。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-71198
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254), and retrieve the response by downloading the image data. This affects both the new POST /v2/images/{id}/locations API and the old PATCH API when show_multiple_locations is enabled. Deployments with the HTTP store backend enabled are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-71198
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-71198
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-71198 (1)
-
🔗 403 Forbidden vendor-advisory
Mailing List Discussions for CVE-2026-71198 (1)
Vendor Pages for CVE-2026-71198 (1)
IV. Related Vulnerabilities
Same weakness: CWE-918
-
CVE-2026-57126
praisonaiagents: SSRF guard validates literal IPs only and n -
CVE-2026-90790
a2aproject a2a-python Push Notification Sender base_push_not -
CVE-2026-57115
PraisonAI: SpiderTools redirect-target SSRF protection bypas -
CVE-2026-90710
taisan tarzan-cms Theme Download Function ThemeService.java -
CVE-2026-90580
FlowiseAI Flowise Evaluations Endpoint index.ts axios.post s
V. Comments for CVE-2026-71198
No comments yet