Nixpkgs security tracker

Permalink CVE-2026-77648

2.2 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 week, 2 days ago Activity log

Created suggestion 1 week, 2 days ago

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import …

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.

References

Affected products

Glance

==32.0.0
<30.3.0
<31.1.1

Matching in nixpkgs

pkgs.glance

Self-hosted dashboard that puts all your feeds in one place

nixos-unstable 0.8.5
- nixpkgs-unstable 0.8.5
- nixos-unstable-small 0.8.5
nixos-26.05 0.8.5
- nixos-26.05-small 0.8.5
- nixpkgs-26.05-darwin 0.8.5

pkgs.glances

Cross-platform curses-based monitoring tool

nixos-unstable 4.5.4
- nixpkgs-unstable 4.5.5
- nixos-unstable-small 4.5.6
nixos-26.05 4.5.5
- nixos-26.05-small 4.5.5
- nixpkgs-26.05-darwin 4.5.5

pkgs.h5glance

Explore HDF5 files in terminal & HTML views

nixos-unstable 0.9
- nixpkgs-unstable 0.9
- nixos-unstable-small 0.9
nixos-26.05 0.9
- nixos-26.05-small 0.9
- nixpkgs-26.05-darwin 0.9

pkgs.glanceclient

Python bindings for the OpenStack Images API

nixos-unstable 4.11.0
- nixpkgs-unstable 4.11.0
- nixos-unstable-small 4.11.0
nixos-26.05 4.11.0
- nixos-26.05-small 4.11.0
- nixpkgs-26.05-darwin 4.11.0

pkgs.python313Packages.glances-api

Python API for interacting with Glances

nixos-unstable 0.10.0
- nixpkgs-unstable 0.10.0
- nixos-unstable-small 0.10.0
nixos-26.05 0.10.0
- nixos-26.05-small 0.10.0
- nixpkgs-26.05-darwin 0.10.0

pkgs.python314Packages.glances-api

Python API for interacting with Glances

nixos-unstable 0.10.0
- nixpkgs-unstable 0.10.0
- nixos-unstable-small 0.10.0
nixos-26.05 0.10.0
- nixos-26.05-small 0.10.0
- nixpkgs-26.05-darwin 0.10.0

pkgs.python313Packages.python-glanceclient

Python bindings for the OpenStack Images API

nixos-unstable 4.11.0
- nixpkgs-unstable 4.11.0
- nixos-unstable-small 4.11.0
nixos-26.05 4.11.0
- nixos-26.05-small 4.11.0
- nixpkgs-26.05-darwin 4.11.0

pkgs.python314Packages.python-glanceclient

Python bindings for the OpenStack Images API

nixos-unstable 4.11.0
- nixpkgs-unstable 4.11.0
- nixos-unstable-small 4.11.0
nixos-26.05 4.11.0
- nixos-26.05-small 4.11.0
- nixpkgs-26.05-darwin 4.11.0

Package maintainers

@dvn0 Devan Carpenter <devan@informatics.coop>
@Defelo Defelo
@anthonyroussel Anthony Roussel <anthony@roussel.dev>
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
@vinetos vinetos <contact+git@vinetos.fr>
@MiniHarinn Harinn <prinn.dev@pm.me>
@k0ral Koral <koral@mailoo.org>
@doronbehar Doron Behar <me@doronbehar.com>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>

Permalink CVE-2026-63770

8.2 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass

Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.