Yaook

By message

yaook@lists.alasca.cloud

September 2026

1 participants
1 discussions

[Security Advisory][glance] Multiple SSRF vulnerabilities (CVE-2026-71196, CVE-2026-71197, CVE-2026-71198)
by Stefan Hoffmann Sept. 3, 2026

Sept. 3, 2026

Hi Yaook users, OpenStack published three CVEs for glance. Sergey Kanibor and Abhishek Kekane reported three related SSRF vulnerabilities in Glance's web-download import method and HTTP image location APIs. The web-download import ships with insecure default filtering that permits authenticated users to fetch arbitrary internal URLs including cloud metadata endpoints. Additionally, the URI validator does not resolve DNS before applying host filters, enabling bypass via attacker-controlled domains and DNS rebinding. The HTTP image location API lacks host filtering entirely when the HTTP store is enabled. Fetched content is stored as image data and can be downloaded, turning blind SSRF into full-read exfiltration. The following images are vulnerable: * glance images before 1.1.165 * yaook release before 3.4.0 If this image is used in your cluster for the glance deployment, the cluster is vulnerable. The fixed image has been built in a private pipeline[2] which has been published alongside this advisory[1] to prove the image provenance. We recommend to add a YAOOK_OP_VERSIONS_OVERRIDE[3] variable to your glance operator container to pull the image before the YAOOK comprehensive release is ready. |operator: extraEnv: - name: YAOOK_OP_VERSIONS_OVERRIDE value: | { "registry.yaook.cloud/yaook/glance-2024.1": "registry.yaook.cloud/yaook/glance-2024.1:1.1.165", "registry.yaook.cloud/yaook/glance-2024.2": "registry.yaook.cloud/yaook/glance-2024.2:1.1.165", "registry.yaook.cloud/yaook/glance-2025.1": "registry.yaook.cloud/yaook/glance-2025.1:1.1.165", "registry.yaook.cloud/yaook/glance-2025.2": "registry.yaook.cloud/yaook/glance-2025.2:1.1.165", "registry.yaook.cloud/yaook/glance-2026.1": "registry.yaook.cloud/yaook/glance-2026.1:1.1.165" }| More info can be found in our security advisory[1]. Regards Stefan [1] https://yaook.cloud/security-advisories-cve-2026-71196-71197-71198/ [2] https://gitlab.com/yaook-security/images/glance/-/pipelines/2813498997 [3] https://docs.yaook.cloud/user/references/env-reference.html#envvar-YAOOK_OP… -- Stefan Hoffmann DevOps Engineer Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com |www.cloudandheat.com Green, Open, Efficient. Your Cloud Service and Cloud Technology Provider from Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

1 0