Server-Side Request Forgery in OpenStack Glance Image API
CVE-2026-51772

6.5MEDIUM

Key Information:

Vendor

OpenStack
Status
Glance
Vendor
CVE Published:
25 September 2026

What is CVE-2026-51772?

In OpenStack Glance's Image API version 2, a critical Server-Side Request Forgery (SSRF) vulnerability has been identified. When the show_multiple_locations setting is activated in the glance-api.conf file, an authenticated user has the potential to exploit this vulnerability by crafting a malicious HTTP PATCH request. This request can manipulate the image location attributes of images that are currently queued, potentially leading to unauthorized access or information disclosure.

References

https://github.com/sadandbset/CVE-2026-51772-CVE-2026-51773

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.