High [CVE-2026-71198] SSRF via location API missing host validation
This high-severity Red Hat Linux advisory covers CVE-2026-71198 affecting Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A server-side request forgery (SSRF) vulnerability was found in OpenStack Glance. When the HTTP store backend is enabled, an authenticated user can add an image location URL pointing to internal network services.
Glance validates only the URL scheme and does not check the host or IP address, allowing the server to make requests to arbitrary internal endpoints. An attacker can read the response by downloading the image, resulting in a full-read SSRF that may expose sensitive data such as cloud metadata credentials.
This vulnerability is rated as Important because an authenticated project member can use the Glance location API as a full-read SSRF proxy to internal HTTP services, including cloud metadata credentials. It is separate from the web-download SSRF fixed in CVE-2026-34881.
Red Hat OpenStack Platform (RHOSP) and Red Hat OpenStack Services on OpenShift (RHOSO) deployments that ship Glance with HTTP store enabled are affected. Deployments without an HTTP store backend are not affected through the new POST /locations API.
The older PATCH location API additionally requires show_multiple_locations=True, which is off by default. Red Hat severity: Important — CVSS 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Weakness: CWE-918.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- The following measures reduce risk: 1. If the HTTP store backend is not required, remove it from enabled_backends in glance-api.conf and restart Glance API. 2. If HTTP store is required, restrict add_image_location to a service-only role (for example add_image_location: rule:service_api). 3. Deploy egress firewall rules on Glance API nodes to block outbound HTTP to link-local and private ranges (169.254.0.0/16, 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.