{"id":"CVE-2026-51772","title":"A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance","summary":"A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locati…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-918"],"published":"2026-09-25","updated":"2026-09-30","sourceUpdated":"2026-09-30T17:23:08.953","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-51772","references":[{"url":"https://github.com/sadandbset/CVE-2026-51772-CVE-2026-51773","label":"cve@mitre.org"},{"url":"https://github.com/sadandbset/CVE-2026-51772-CVE-2026-51773/blob/main/CVE-2026-51772.md","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-51772.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-51772"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2541411"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-51772"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-51772"}],"tags":["nvd","exploit-available","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00301,"epssPercentile":0.22632,"exploits":{"github":1,"githubRepos":["https://github.com/sadandbset/CVE-2026-51772-CVE-2026-51773"],"checkedAt":"2026-10-27T19:02:28.474Z"},"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-29T15:56:47.606213Z"},"ingestedAt":"2026-09-25T13:08:53.488Z","vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","affected":["openstack_platform_13_queens","openstack_platform 16.2","openstack_platform 17.1","openstack_platform 18.0"],"scores":{"nvd":6.5,"vendor":4.3},"slug":"CVE-2026-51772","body":"## Overview\n\nA Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted HTTP PATCH request\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · updated 2026-10-06 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-51772.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":212743,"id":"CVE-2026-51772","ts":1790700024622,"field":"cvss","old":"8.1","new":"6.5"},{"seq":212742,"id":"CVE-2026-51772","ts":1790700024622,"field":"severity","old":"high","new":"medium"},{"seq":212236,"id":"CVE-2026-51772","ts":1790652426591,"field":"cvss","old":null,"new":"8.1"},{"seq":212235,"id":"CVE-2026-51772","ts":1790652426591,"field":"severity","old":"none","new":"high"}]}