Medium [CVE-2026-71197] SSRF blocklist bypass via hostname-to-IP resolution gap in web-download
This medium-severity Red Hat Linux advisory covers CVE-2026-71197 affecting Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in OpenStack Glance. The web-download image import method can bypass host-based blocklist filtering.
When an operator configures disallowed_hosts with IP addresses to block access to internal services, an attacker can circumvent this protection by using a hostname that resolves to the blocked IP address.
The hostname-to-IP resolution result is not used for blocklist comparison, allowing an authenticated user to force the Glance server to make requests to internal network services that were intended to be blocked.
This vulnerability is rated as Moderate because it requires an authenticated OpenStack user with image import permissions, and it is a bypass of an optional IP blocklist rather than a default-open SSRF. Default disallowed_hosts is empty, so this specific bypass only matters on deployments that already configured host filtering.
Deployments that do not use web-download are not affected by this bypass. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Weakness: CWE-918. Affected Red Hat products: Red Hat OpenStack Platform 13 (Queens); Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.
Red Hat does not currently list a fixing RHSA for this CVE.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- The following measures reduce risk: 1. Remove web-download from enabled_import_methods in glance-api.conf if the method is not required: enabled_import_methods = glance-direct, copy-image 2. If web-download is required, use allowed_hosts (allowlist of trusted source hostnames) instead of disallowed_hosts. This prevents attacker-controlled domains from being accepted. It does not fully address DNS rebinding between validation and fetch.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.