CVE-2026-71198
Severity not reportedIn OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image.
In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254), and retrieve the response by downloading the image data. This affects both the new POST /v2/images/{id}/locations API and the old PATCH API when show_multiple_locations is enabled. Deployments with the HTTP store backend enabled are affected.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://launchpad.net/bugs/2161330 cve@mitre.org
- https://openwall.com/lists/oss-security/2026/09/03/2 cve@mitre.org
- https://security.openstack.org/ossa/OSSA-2026-038.html cve@mitre.org