glance
OpenStack Image Service
Activity
- Latest release
- 4d ago
- Total releases
- 91
- Cadence
- ~24 days
- Last 12 months
- 15
Details
- License
- Apache-2.0
- First release
- Jan 30, 2019
| Version | Released | |
|---|---|---|
33.0.0.0rc1
pre
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
33.0.0.0rc1
pre
Dependencies (38)
+ 30 more |
|
33.0.0.0b2
pre
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
33.0.0.0b2
pre
Dependencies (36)
+ 28 more |
|
29.2.1
patch
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
29.2.1
patch
Dependencies (41)
+ 33 more |
|
32.0.0
major
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
32.0.0
major
Dependencies (39)
+ 31 more |
|
31.1.0
minor
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
31.1.0
minor
Dependencies (39)
+ 31 more |
|
30.2.0
minor
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
30.2.0
minor
Dependencies (39)
+ 31 more |
|
29.2.0
minor
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
29.2.0
minor
Dependencies (41)
+ 33 more |
|
32.0.0.0rc2
pre
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
32.0.0.0rc2
pre
Dependencies (39)
+ 31 more |
|
32.0.0.0rc1
pre
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
32.0.0.0rc1
pre
Dependencies (39)
+ 31 more |
|
32.0.0.0b2
pre
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
32.0.0.0b2
pre
Dependencies (39)
+ 31 more |
|
31.0.0.0b2
pre
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
31.0.0.0b2
pre
Dependencies (39)
+ 31 more |
|
30.1.0
minor
2 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
30.1.0
minor
Dependencies (39)
+ 31 more |
|
29.1.0
minor
2 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
29.1.0
minor
Dependencies (41)
+ 33 more |
|
28.2.0
minor
2 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
28.2.0
minor
Dependencies (42)
+ 34 more |
|
31.0.0
major
2 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
31.0.0
major
Dependencies (39)
+ 31 more |
|
31.0.0.0rc1
pre
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
31.0.0.0rc1
pre
Dependencies (39)
+ 31 more |
|
27.1.1
patch
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
27.1.1
patch
Dependencies (43)
+ 35 more |
|
30.0.0
major
2 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
30.0.0
major
Dependencies (39)
+ 31 more |
|
30.0.0.0rc1
pre
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
30.0.0.0rc1
pre
Dependencies (39)
+ 31 more |
|
30.0.0.0b2
pre
1 CVE
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
30.0.0.0b2
pre
Dependencies (40)
+ 32 more |
|
29.0.0
major
2 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
29.0.0
major
Dependencies (41)
+ 33 more |
|
29.0.0.0rc1
pre
2 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
29.0.0.0rc1
pre
Dependencies (41)
+ 33 more |
|
29.0.0.0b3
pre
2 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
29.0.0.0b3
pre
Dependencies (41)
+ 33 more |
|
27.1.0
minor
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
27.1.0
minor
Dependencies (43)
+ 35 more |
|
28.1.0
minor
2 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
28.1.0
minor
Dependencies (42)
+ 34 more |
|
26.1.0
minor
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
26.1.0
minor
Dependencies (43)
+ 35 more |
|
29.0.0.0b2
pre
2 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
29.0.0.0b2
pre
Dependencies (41)
+ 33 more |
|
29.0.0.0b1
pre
2 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
29.0.0.0b1
pre
Dependencies (42)
+ 34 more |
|
28.0.1
patch
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
28.0.1
patch
Dependencies (42)
+ 34 more |
|
28.0.0
major
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
28.0.0
major
Dependencies (42)
+ 34 more |
|
28.0.0.0rc1
pre
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
28.0.0.0rc1
pre
Dependencies (42)
+ 34 more |
|
28.0.0.0b2
pre
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
28.0.0.0b2
pre
Dependencies (42)
+ 34 more |
|
27.0.0
major
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
27.0.0
major
Dependencies (43)
+ 35 more |
|
27.0.0.0rc1
pre
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
27.0.0.0rc1
pre
Dependencies (43)
+ 35 more |
|
24.2.1
patch
4 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev
CVE-2022-4134
GHSA-5gp5-vxj6-4257
PYSEC-2023-270
Mar 07, 2023
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability
2.8
/ 10
Low
Local
Low
Low
Required
Unchanged
None
Low
None
A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 39 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
References
Updated Mar 06, 2025 · Source: OSV.dev |
24.2.1
patch
Dependencies (43)
+ 35 more |
|
27.0.0.0b2
pre
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
27.0.0.0b2
pre
Dependencies (43)
+ 35 more |
|
27.0.0.0b1
pre
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
27.0.0.0b1
pre
Dependencies (43)
+ 35 more |
|
26.0.0
major
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
26.0.0
major
Dependencies (43)
+ 35 more |
|
26.0.0.0rc1
pre
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
26.0.0.0rc1
pre
Dependencies (43)
+ 35 more |
|
26.0.0.0b3
pre
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
26.0.0.0b3
pre
Dependencies (43)
+ 35 more |
|
25.1.0
minor
4 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev
CVE-2022-4134
GHSA-5gp5-vxj6-4257
PYSEC-2023-270
Mar 07, 2023
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability
2.8
/ 10
Low
Local
Low
Low
Required
Unchanged
None
Low
None
A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 39 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
References
Updated Mar 06, 2025 · Source: OSV.dev |
25.1.0
minor
Dependencies (43)
+ 35 more |
|
24.2.0
minor
4 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev
CVE-2022-4134
GHSA-5gp5-vxj6-4257
PYSEC-2023-270
Mar 07, 2023
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability
2.8
/ 10
Low
Local
Low
Low
Required
Unchanged
None
Low
None
A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 39 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
References
Updated Mar 06, 2025 · Source: OSV.dev |
24.2.0
minor
Dependencies (43)
+ 35 more |
|
23.1.0
minor
4 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev
CVE-2022-4134
GHSA-5gp5-vxj6-4257
PYSEC-2023-270
Mar 07, 2023
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability
2.8
/ 10
Low
Local
Low
Low
Required
Unchanged
None
Low
None
A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 39 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
References
Updated Mar 06, 2025 · Source: OSV.dev |
23.1.0
minor
Dependencies (44)
+ 36 more |
|
26.0.0.0b2
pre
3 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev |
26.0.0.0b2
pre
Dependencies (43)
+ 35 more |
|
22.1.1
patch
5 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2022-47951
PYSEC-2026-2490
GHSA-7h75-hwxx-qpgc
PYSEC-2026-2411
PYSEC-2026-868
Jul 13, 2026
OpenStack Cinder, glance, and Nova vulnerable to Path Traversal
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
High
None
None
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 30 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
24.0.0
24.1.0
Fixed in
23.0.1
24.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev
CVE-2022-4134
GHSA-5gp5-vxj6-4257
PYSEC-2023-270
Mar 07, 2023
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability
2.8
/ 10
Low
Local
Low
Low
Required
Unchanged
None
Low
None
A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 39 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
References
Updated Mar 06, 2025 · Source: OSV.dev |
22.1.1
patch
Dependencies (44)
+ 36 more |
|
25.0.0
major
4 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev
CVE-2022-4134
GHSA-5gp5-vxj6-4257
PYSEC-2023-270
Mar 07, 2023
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability
2.8
/ 10
Low
Local
Low
Low
Required
Unchanged
None
Low
None
A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 39 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
References
Updated Mar 06, 2025 · Source: OSV.dev |
25.0.0
major
Dependencies (43)
+ 35 more |
|
25.0.0.0rc1
pre
4 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev
CVE-2022-4134
GHSA-5gp5-vxj6-4257
PYSEC-2023-270
Mar 07, 2023
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability
2.8
/ 10
Low
Local
Low
Low
Required
Unchanged
None
Low
None
A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 39 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
References
Updated Mar 06, 2025 · Source: OSV.dev |
25.0.0.0rc1
pre
Dependencies (43)
+ 35 more |
|
25.0.0.0b3
pre
4 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev
CVE-2022-4134
GHSA-5gp5-vxj6-4257
PYSEC-2023-270
Mar 07, 2023
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability
2.8
/ 10
Low
Local
Low
Low
Required
Unchanged
None
Low
None
A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 39 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
References
Updated Mar 06, 2025 · Source: OSV.dev |
25.0.0.0b3
pre
Dependencies (43)
+ 35 more |
|
25.0.0.0b2
pre
4 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev
CVE-2022-4134
GHSA-5gp5-vxj6-4257
PYSEC-2023-270
Mar 07, 2023
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability
2.8
/ 10
Low
Local
Low
Low
Required
Unchanged
None
Low
None
A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 39 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
References
Updated Mar 06, 2025 · Source: OSV.dev |
25.0.0.0b2
pre
Dependencies (43)
+ 35 more |
|
24.1.0
minor
5 CVEs
CVE-2026-34881
PYSEC-2026-2492
GHSA-mc26-q38v-83gv
Jul 13, 2026
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
5.0
/ 10
Medium
Network
Low
Low
None
Changed
None
Low
None
OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 65 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
30.0.0
30.1.0
31.0.0
Fixed in
29.2.0
30.2.0
31.1.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-32498
PYSEC-2026-2493
GHSA-r4v4-w9pv-6fph
PYSEC-2026-1708
PYSEC-2026-2414
Jul 13, 2026
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
High
Network
Low
Low
None
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 54 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2022-47951
PYSEC-2026-2490
GHSA-7h75-hwxx-qpgc
PYSEC-2026-2411
PYSEC-2026-868
Jul 13, 2026
OpenStack Cinder, glance, and Nova vulnerable to Path Traversal
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
High
None
None
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 30 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
24.0.0
24.1.0
Fixed in
23.0.1
24.1.1
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2015-5286
PYSEC-2026-812
GHSA-gvjg-r9fv-7qx9
Jul 06, 2026
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 78 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
26.0.0
26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.1.0
27.0.0
27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.1.0
27.1.1
28.0.0
28.0.0.0b2
28.0.0.0rc1
28.0.1
28.1.0
28.2.0
29.0.0
29.0.0.0b1
29.0.0.0b2
29.0.0.0b3
29.0.0.0rc1
29.1.0
29.2.0
29.2.1
30.0.0
30.0.0.0b2
30.0.0.0rc1
30.1.0
30.2.0
31.0.0
31.0.0.0b2
31.0.0.0rc1
31.1.0
32.0.0
32.0.0.0b2
32.0.0.0rc1
32.0.0.0rc2
33.0.0.0b2
Fixed in
2014.2.4
2015.1.2
References Updated Jul 09, 2026 · Source: OSV.dev
CVE-2022-4134
GHSA-5gp5-vxj6-4257
PYSEC-2023-270
Mar 07, 2023
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability
2.8
/ 10
Low
Local
Low
Low
Required
Unchanged
None
Low
None
A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. Affected versions
15.0.2
17.0.1
18.0.0
18.0.0.0b1
18.0.0.0rc1
18.0.1
19.0.0
19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.1
19.0.2
+ 39 more Show less
19.0.3
19.0.4
20.0.0
20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.1
20.1.0
20.2.0
21.0.0
21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.1.0
22.0.0
22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.1.0
22.1.1
23.0.0
23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.1.0
24.0.0
24.0.0.0rc1
24.1.0
24.2.0
24.2.1
25.0.0
25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.1.0
References
Updated Mar 06, 2025 · Source: OSV.dev |
24.1.0
minor
Dependencies (43)
+ 35 more |