CVE-2026-51772: OpenStack Glance Image API SSRF Vulnerability

CVE-2026-51772 Overview

CVE-2026-51772 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Image API (v2) of OpenStack Glance. The flaw exists when the show_multiple_locations configuration option is enabled in glance-api.conf. An authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted HTTP PATCH request. This allows the Glance service to issue outbound requests to attacker-controlled destinations, including internal network endpoints that would otherwise be unreachable.

Critical Impact
Authenticated attackers can abuse the Glance Image API to perform SSRF against internal services, exposing confidential data from the cloud control plane.

Affected Products

OpenStack Glance Image API (v2)
Glance deployments where show_multiple_locations = True is configured in glance-api.conf
OpenStack environments exposing the Glance API to authenticated tenants

Discovery Timeline

2026-09-25 - CVE-2026-51772 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-51772

Vulnerability Analysis

OpenStack Glance manages image metadata and the storage locations where image data resides. When show_multiple_locations is enabled, the Image API v2 exposes and accepts modifications to the locations field of an image resource. The vulnerable code path accepts URLs supplied by an authenticated tenant through a PATCH request against an image in the queued state. Glance then processes those URLs server-side without adequately restricting the destination scheme, host, or network range.

The result is a classic Server-Side Request Forgery condition. An attacker with valid credentials in any project can direct the Glance service to connect to arbitrary network destinations reachable from the API host. These typically include cloud metadata services, internal management APIs, and services bound to loopback or management interfaces.

Root Cause

The root cause is insufficient validation and allow-listing of URLs supplied through the locations attribute on queued images. The API trusts tenant-provided URL input and does not restrict outbound requests to approved backends. Combined with the show_multiple_locations option, this expands the attack surface of the Image API beyond its intended image-storage interactions.

Attack Vector

Exploitation requires network access to the Glance API and valid authentication tokens, consistent with the Network attack vector and Low privileges required attributes. The attacker first creates an image, which enters the queued state. The attacker then issues an HTTP PATCH request to /v2/images/{image_id} with a JSON Patch operation adding a crafted URL to the locations array. Glance processes the location, triggering server-side requests to the attacker-chosen target. Technical reproduction details are published in the GitHub PoC repository and the CVE-2026-51772 documentation.

Detection Methods for CVE-2026-51772

Indicators of Compromise

HTTP PATCH requests to /v2/images/{image_id} from tenant accounts that add non-standard URLs to the locations attribute.
Outbound connections from Glance API hosts to internal RFC1918 ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
Image resources created and left in the queued state while being repeatedly modified by the same tenant.

Detection Strategies

Enable Glance API access logging and alert on PATCH operations that modify the locations attribute, especially with schemes other than approved storage backends.
Correlate Glance API request logs with egress network flows from the API host to identify requests directed at unexpected destinations.
Review audit records for authenticated users creating many short-lived images in the queued state.

Monitoring Recommendations

Forward glance-api logs and host network telemetry to a centralized analytics platform for correlation across the control plane.
Deploy network monitoring on OpenStack control-plane subnets to flag connections from Glance to management or metadata services.
Baseline normal Glance outbound destinations and alert on deviations introduced after image PATCH operations.

How to Mitigate CVE-2026-51772

Immediate Actions Required

Set show_multiple_locations = False in glance-api.conf unless the deployment explicitly requires it, then restart the glance-api service.
Audit tenant permissions and restrict image creation and modification to trusted projects where feasible.
Review recent Glance API activity for suspicious PATCH requests targeting the locations attribute.

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry for CVE-2026-51772. Operators should monitor the OpenStack security advisories and the Glance project release notes for an official fix and upgrade affected deployments once a patched release is available. Reference material is available in the GitHub CVE-2026-51772 documentation.

Workarounds

Disable show_multiple_locations in glance-api.conf to prevent tenant-controlled modification of the locations attribute.
Enforce egress filtering on Glance API hosts so that only approved storage backends are reachable from the service.
Block Glance host access to cloud metadata endpoints and internal management interfaces using host firewall or network policy.

bash

# Configuration example: disable multiple locations in glance-api.conf
[DEFAULT]
show_multiple_locations = False

# Restart the Glance API service to apply the change
sudo systemctl restart glance-api