A critical SSRF vulnerability in OpenStack Glance allows authenticated attackers to perform unauthorized requests to internal infrastructure, potentially leading to sensitive data exposure.

The vulnerability is a Server-Side Request Forgery (CWE-918) within the location API, which fails to apply necessary host restrictions when adding HTTP locations to images. An authenticated user can exploit this to query internal services, such as the cloud metadata service at 169.254.169.254, and retrieve the output via image download.

Successful exploitation poses a significant risk to cloud security, as it enables attackers to bypass network perimeters and interact with internal-only services. With a CVSS score of 7.0, this high-severity flaw could lead to the theft of sensitive configuration data, cloud credentials, or service metadata, resulting in broader unauthorized access to the cloud environment.

Immediate Action: Upgrade OpenStack Glance to version 30.2.1, 31.1.1, or 32.0.1 immediately to implement the required host validation logic.

Proactive Monitoring: Monitor API access logs for unusual patterns, specifically POST and PATCH requests to the image location endpoints that target private or link-local IP addresses.

Compensating Controls: If patching is delayed, disable the HTTP store backend if not strictly required, or utilize network egress filtering to prevent the Glance service from reaching sensitive internal metadata endpoints.

Public Exploit Available: No

Given the high potential for internal reconnaissance and information disclosure, organizations should prioritize the deployment of the provided security updates. Administrators must verify that their specific OpenStack deployment is running the patched versions, as the internal metadata service is a high-value target for attackers seeking to escalate privileges within a cloud environment.