What is CVE-2026-77648?

CVE-2026-77648 is a low-severity vulnerability in OpenStack Glance, classified under Server-Side Request Forgery (SSRF). CVSS score: 2.2/10. Published 2026-08-20.

How severe is CVE-2026-77648?

Low severity. CVSS v3 base score is 2.2 out of 10.

SSRF in OpenStack Glance

CVE-2026-77648

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.

Vulnerability class: SSRF (Server-Side Request Forgery)

CVSS v3 metric

CVSS v3 base score 2.2 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N.

Affected products

Openstack Glance — versions 32.0.0

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

cve@mitre.org
cve@mitre.org

Frequently asked questions

What is CVE-2026-77648?: CVE-2026-77648 is a low-severity vulnerability in OpenStack Glance, classified under Server-Side Request Forgery (SSRF). CVSS score: 2.2/10. Published 2026-08-20.
How severe is CVE-2026-77648?: Low severity. CVSS v3 base score is 2.2 out of 10.