Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-04T08:36:24 openstack-glance: openstack-glance: SSRF blocklist bypass via hostname-to-IP resolution gap in web-download 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CWE-918

A flaw was found in OpenStack Glance. The web-download image import method can bypass host-based blocklist filtering. When an operator configures disallowed_hosts with IP addresses to block access to internal services, an attacker can circumvent this protection by using a hostname that resolves to the blocked IP address. The hostname-to-IP resolution result is not used for blocklist comparison, allowing an authenticated user to force the Glance server to make requests to internal network services that were intended to be blocked.

This vulnerability is rated as Moderate because it requires an authenticated OpenStack user with image import permissions, and it is a bypass of an optional IP blocklist rather than a default-open SSRF. Default disallowed_hosts is empty, so this specific bypass only matters on deployments that already configured host filtering. Red Hat OpenStack Services on OpenShift (RHOSO) and Red Hat OpenStack Platform (RHOSP) deployments that ship Glance with web-download enabled are in scope. Deployments that do not use web-download are not affected by this bypass. Upstream acknowledges Cyril Roelandt (Red Hat) as the original reporter. Config changes are workarounds. Upgrade to the patched Glance release. The strongest config-only control is to disable web-download: enabled_import_methods = glance-direct, copy-image Using allowed_hosts as a whitelist of trusted source hostnames is a valid workaround, but DNS rebinding remains possible until the patch is applied. Red Hat OpenStack Platform 13 (Queens) Fix deferred openstack-glance Red Hat OpenStack Platform 16.2 Fix deferred openstack-glance Red Hat OpenStack Platform 17.1 Fix deferred openstack-glance Red Hat OpenStack Platform 18.0 Fix deferred openstack-glance https://www.cve.org/CVERecord?id=CVE-2026-71197 https://nvd.nist.gov/vuln/detail/CVE-2026-71197 https://bugs.launchpad.net/glance/+bug/2158999 https://redhat.atlassian.net/browse/OSPRH-32931