An authenticated attacker who supplies a maliciously crafted image location URI to the VMware datastore driver in OpenStack Glance Store can cause that driver to forward the request to an external server without validating the host. Because the driver attaches sensitive authentication headers to the _retry_request call, those credentials are sent to the attacker-controlled destination. This leads to a disclosure of authentication information that could be reused for further compromises. The flaw corresponds to CWE-201 (Information Exposure) and CWE-918 (Server‑Side Request Forgery).

The vulnerability is specific to the OpenStack Glance Store component, targeting the VMware datastore driver. No vendor or version details are publicly disclosed at this time, so any OpenStack deployment that enables this driver remains potentially susceptible. The issue does not affect other OpenStack services that do not use the VMware datastore driver.

The CVSS score of 8.1 reflects high severity, yet the EPSS score is currently unavailable and the flaw is not in the CISA KEV catalog. Exploitation requires authentication to the OpenStack environment, making it a threat mainly to insiders or attackers who have compromised credentials. If the attacker can supply a suitable location URI, the vulnerability effectively performs a server-side request forgery, potentially exfiltrating the victim’s authentication tokens. While no public exploits are known, the high CVSS and the ability to capture credentials make the risk significant if left unremedied.