-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| glance | pip | < 11.0.0a0 | 11.0.0a0 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from the 'copy_from' feature in Glance's v1 API being accessible without proper access controls. The GitHub patch explicitly adds a policy check (self._enforce(req, 'copy_from')) in the create method of images.py, indicating this was the missing security control. The pre-patch code allowed any user to supply a 'copy_from' URL, which Glance would fetch server-side, enabling SSRF. The added unit tests in test_api.py validate that unauthorized copy_from usage is now blocked, confirming the function's prior vulnerability.