This vulnerability is a server‑side request forgery that allows an authenticated user to supply a URI for the web‑download image import method. Glance fetches data from that URI and stores the response as image data, which the attacker can later download. The weakness permits requests to any internal host, including the cloud metadata service, enabling exfiltration of sensitive data such as instance credentials. The flaw is a typical example of CWE‑918, where insufficient host filtering opens internal resources to external control.

The affected component is OpenStack Glance, the image service used in OpenStack cloud deployments. No specific product version details are provided in the advisory, so the vulnerability could potentially affect any unpatched installation that includes the web‑download import feature.

The CVSS base score of 7.7 reflects a high severity for this SSRF. EPSS information is not yet available, so current exploitation probability is unknown, but the flaw is not in the CISA KEV catalog. An attacker only needs legitimate tenant credentials to activate the flaw, meaning a compromised or rogue tenant can collect internal secrets. The attack vector is inferred to be a remote SSRF via the web‑download function; the exploit does not require further local privilege escalation or additional software or network access beyond what a normal user has within the cloud environment.