An administrator can trigger an import task through the /v2/tasks API endpoint, which bypasses the normal import_filtering_opts check. When the type parameter is set to import, the service will accept any URL that begins with http:// or https:// and retrieve data from that location. This allows the administrator to fetch content from internal network resources that would otherwise be unreachable from the public network, leading to potential internal enumeration or disclosure of internal services.

OpenStack Glance, all releases up to and including 32.0.0, where the /v2/tasks endpoint accepts a type=import task. The API is accessible only to users with administrative privileges and has been deprecated since the Xena release.

The CVSS score of 2.2 indicates low overall risk, and the vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires administrative credentials to Glance; the attacker must target internal URLs that use http:// or https://. The lack of an EPSS score suggests limited publicly known exploitation activity. Nevertheless, the SSRF potential could aid an attacker in mapping the internal network or accessing other privileged services if those services are reachable via the Glance host.