A flaw in OpenStack Glance (CWE‑918, Server‑Side Request Forgery) allows an authenticated user to bypass host‑based blocklist filtering when importing images via the web‑download method. By specifying a hostname that resolves to an IP address listed in "disallowed_hosts", the server performs request validation against the hostname only and does not check the resolved IP against the blocklist. This enables the Glance server to make internal network requests that should have been blocked, potentially exposing internal services.

OpenStack Glance. No specific version information is available.

The severity score of 4.3 indicates moderate risk, and the vulnerability has not been listed in the CISA KEV catalog. Because the exploit requires a valid authenticated account, it is likely confined to internal attackers who have legitimate access to the Glance server. The known exploit path involves configuring the disallowed_hosts list with IP addresses, then supplying a hostname that resolves to one of those addresses during a web‑download import, thereby circumventing the blocklist. The lack of an EPSS score suggests low to moderate exploitation probability at this time, but the potential for internal lateral movement warrants timely remediation.