CVE-2026-34881

OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.

• CWE-918
• CWE-918

• https://bugs.launchpad.net/glance/+bug/2138602Exploit, Issue Tracking, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2026-004.htmlPatch, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:39812
• https://access.redhat.com/security/cve/CVE-2026-34881
• https://bugs.launchpad.net/glance/+bug/2138602Exploit, Issue Tracking, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2440368
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34881.json

Published

Mar 31, 2026

Last Modified

Jul 15, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34873An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Cli…9.1
• CVE-2026-34874An issue was discovered in Mbed TLS through 3.6.5 and 4.x th…7.5
• CVE-2026-34875An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA…9.8
• CVE-2026-34876An issue was discovered in Mbed TLS 3.x before 3.6.6. An out…7.5
• CVE-2026-34877An issue was discovered in Mbed TLS versions from 2.19.0 up …9.8
• CVE-2026-3488The WP Statistics plugin for WordPress is vulnerable to Miss…6.5
• CVE-2026-34882Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE…
• CVE-2026-34883An issue was discovered in the Portrait Dell Color Managemen…5.3
• CVE-2026-34885Improper Neutralization of Special Elements used in an SQL C…8.5
• CVE-2026-34886Unauthenticated Broken Access Control in Simple Membership <…7.5
• CVE-2026-34887Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-34888Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.…7.5