High [CVE-2026-71196] SSRF via web-download import due to empty default host filters
This high-severity Red Hat Linux advisory covers CVE-2026-71196 affecting Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A server-side request forgery (SSRF) vulnerability was found in OpenStack Glance. The web-download image import method allows authenticated users to provide a URI from which the Glance service fetches data.
Due to insufficient default host filtering, an attacker with standard tenant credentials can make Glance issue HTTP requests to arbitrary internal network hosts, including the cloud metadata service.
The fetched response is stored as image data and can be downloaded by the attacker, enabling exfiltration of sensitive internal data such as cloud instance credentials.
This vulnerability is rated as Important because an authenticated tenant with the standard member role can use Glance as a full-read SSRF proxy to internal HTTP services, including cloud metadata credentials. No administrative role is required.
Red Hat OpenStack Services on OpenShift (RHOSO) and Red Hat OpenStack Platform (RHOSP) deployments that ship OpenStack Glance with web-download enabled are affected.
Deployments that have removed web-download from enabled_import_methods, or that have explicitly configured disallowed_hosts to block internal IP ranges, are not affected by the default-config path. Red Hat severity: Important — CVSS 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Weakness: CWE-918.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- There is no complete mitigation while web-download remains enabled with default host filters. The following measures reduce risk: 1. Remove web-download from enabled_import_methods in glance-api.conf if the method is not required: enabled_import_methods = glance-direct, copy-image 2. If web-download is required, configure [import_filtering_opts] disallowed_hosts to block internal ranges (169.254.169.254, 127.0.0.1, RFC1918). Hostname-based filtering may still be bypassable via DNS rebinding. 3. Disabling the feature entirely is the more robust mitigation.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.