All vulnerabilities
CVE-2026-51772

A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticat

n/a n/aContainers & cloud
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 29 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published25 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted HTTP PATCH request

Text from CVE List

Affected versions 1

  • n/aaffected: n/aCVE List

References 2