This security update addresses multiple Server-Side Request Forgery (SSRF) vulnerabilities in OpenStack Glance (CVE-2026-34881, CVSS 5.0), specifically involving unvalidated URI fetching during OVF processing and a redirect validation bypass in glance-download, which could allow unauthorized internal network access. The vulnerabilities affect openstack-glance versions prior to 29.1.1, and versions 30.0.0 through 30.1.1, as well as version 31.0.0. The fix requires upgrading to version 29.1.1, 30.1.1, or a later patched release.
Red Hat Product Errata RHSA-2026:39812 - Security Advisory Issued: 2026-07-15 Updated: 2026-07-15 RHSA-2026:39812 - Security Advisory Overview Updated Packages Synopsis Important: Red Hat OpenStack Services on OpenShift 18.0 (openstack-glance) security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for openstack-glance is now available for Red Hat OpenStack Services on OpenShift 18.0 (Antelope). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description OpenStack Image Service (code-named Glance) provides discovery, registration, and delivery services for virtual disk images. The Image Service API server provides a standard REST interface for querying information about virtual disk images stored in a variety of back-end stores, including OpenStack Object Storage. Clients can register new virtual disk images with the Image Service, query for information on publicly available disk images, and use the Image Service's client library for streaming virtual disk images. Security Fix(es): openstack-glance: OpenStack Glance – Unvalidated URI Fetch in OVF Processing (SSRF) () openstack-glance: OpenStack Glance – Redirect Validation Bypass in glance-download Import (SSRF) () OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access (CVE-2026-34881) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat OpenStack Services on OpenShift 18.0 x86_64 Fixes BZ - 2440353 - openstack-glance: OpenStack Glance ? Unvalidated URI Fetch in OVF Processing (SSRF) BZ - 2440358 - openstack-glance: OpenStack Glance ? Redirect Validation Bypass in glance-download Import (SSRF) BZ - 2440368 - CVE-2026-34881 openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access CVEs CVE-2026-34881 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat OpenStack Services on OpenShift 18.0 SRPM openstack-glance-26.1.1-18.0.20260422134725.c2ac316.el9ost.src.rpm SHA-256: 4a2c4f091ccf2cb79ab7f33ff0a62cb9982d738675b5f71653b721179795d819 x86_64 openstack-glance-26.1.1-18.0.20260422134725.c2ac316.el9ost.noarch.rpm SHA-256: c0e26e67c6ac16a9d46af84f29cfd70100999267494ca591b90fc978b9df6952 python3-glance-26.1.1-18.0.20260422134725.c2ac316.el9ost.noarch.rpm SHA-256: 51749501d3bacde5a5a5d5a8dd6a33e1f19cddb93c178f17fa4c4f5a232756df The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .