CVE-2026-71198

Name	CVE-2026-71198
Description	In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254), and retrieve the response by downloading the image data. This affects both the new POST /v2/images/{id}/locations API and the old PATCH API when show_multiple_locations is enabled. Deployments with the HTTP store backend enabled are affected.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1146594

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glance (PTS)	bookworm	2:25.1.0-2+deb12u3	vulnerable
	bookworm (security)	2:25.1.0-2+deb12u1	vulnerable
	trixie	2:30.0.0-3+deb13u2	vulnerable
	forky	2:32.0.0-3	vulnerable
	sid	2:33.0.0~rc1-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
glance	source	(unstable)	2:32.0.0-4			1146594

[trixie] - glance <no-dsa> (Minor issue)
[bookworm] - glance <postponed> (Minor issue)
https://security.openstack.org/ossa/OSSA-2026-038.html