OSSN-0105: Glance legacy Tasks import bypasses image import URI filtering¶
Summary¶
The deprecated Glance /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (SSRF). The tasks API has been admin-only since Xena and deprecated for several releases.
Affected Services / Software¶
glance (>=30.0.0 <30.3.0, >=31.0.0 <31.1.1, ==32.0.0)
Discussion¶
The legacy tasks import path uses a permissive URI validator that only checks for http:// or https:// prefixes, bypassing the host and port restrictions enforced by the modern web-download import.
Recommended Actions¶
Disable the legacy tasks API via policy if you are not using it. Otherwise, upgrade Glance to a version containing the fix.
Patches:
The following reviews contain the fix for this issue:
2026.2/hibiscus (development): https://review.opendev.org/c/openstack/glance/+/993588
2026.1/gazpacho: https://review.opendev.org/c/openstack/glance/+/994466
2025.2/flamingo: https://review.opendev.org/c/openstack/glance/+/994592
2025.1/epoxy: https://review.opendev.org/c/openstack/glance/+/1000061
Credits:
Tim Shephard, roiai.ca
Contacts / References¶
Author: Goutham Pacha Ravi, Red Hat
This OSSN : https://docs.openstack.org/security-notes/OSSN-0105.html
Original Launchpad bug : https://bugs.launchpad.net/glance/+bug/2152110
Mailing List [security-sig] tag on : openstack-discuss@lists.openstack.org
OpenStack Security : https://security.openstack.org/
CVE : none
