« Volver al listado

CVE-2026-77648

Estado: Pendiente de análisisBaja (2.2)—

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Openstack — GlanceAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-77648",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77648",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-24T15:59:54.266914Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 2.2,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 0.7
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "OpenStack",
          "product": "Glance",
          "versions": [
            {
              "status": "affected",
              "version": "30.0.0",
              "lessThan": "30.3.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "31.0.0",
              "lessThan": "31.1.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "32.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-08-20T23:16:28.797",
  "references": [
    {
      "url": "https://wiki.openstack.org/wiki/OSSN/OSSN-0105",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2026/08/11/7",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that\nbypass import_filtering_opts, allowing an admin to fetch internal\nURLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases."
    }
  ],
  "lastModified": "2026-09-09T16:03:22.897",
  "sourceIdentifier": "cve@mitre.org"
}