CVE-2017-7200
MediumCVSS 5.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
OpenStack Glance before Newton has an SSRF vulnerability in the 'copy_from' feature of the Image Service API v1. An attacker can create images with URLs like 'http://localhost:22' to perform masked internal port scans.
Risk Assessment
An attacker can gather internal network details such as open ports, which may facilitate further attacks.
Recommendation
Update OpenStack Glance to Newton or later which includes the fix.
Other vulnerabilities in OpenStack Glance
See all- CVE-2026-51772Medium
A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted HTTP PATCH request.
- CVE-2026-71198High
In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254) and retrieve the response by downloading the image data.
- CVE-2026-77648Low
OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (SSRF).
- CVE-2026-34881Medium
OpenStack Glance before versions 29.1.1, 30.1.1, and 31.0.0 is vulnerable to Server-Side Request Forgery (SSRF). An authenticated user can bypass URL validation checks using HTTP redirects to access internal services. The vulnerability affects only the image import functionality, specifically the web-download and glance-download import methods, as well as the optional ovf_process plugin.
- CVE-2013-1840Medium
A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.
Original NVD description (English source)
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS