CVE-2026-63770: Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass
Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Glanceto a version that resolves this vulnerability.Fixed in 0.8.5 - Configuration
Disable the server proxied option so the authentication handler does not trust arbitrary X-Forwarded-For values from requests, preventing bypass of brute-force lockout protections.
Glance authentication handler (proxy/X-Forwarded-For handling) server proxied option = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63770?
The severity of CVE-2026-63770 is rated as high with a CVSS score of 7.5.
How do I fix CVE-2026-63770?
To fix CVE-2026-63770, upgrade to a version of OpenStack Glance that addresses this vulnerability.
What types of attacks does CVE-2026-63770 allow?
CVE-2026-63770 allows unauthenticated attackers to bypass brute-force lockout protections by spoofing the IP address.
What software is affected by CVE-2026-63770?
CVE-2026-63770 affects OpenStack Glance version 0.8.5.
What is the impact of exploiting CVE-2026-63770?
Exploiting CVE-2026-63770 can allow attackers to successfully authenticate by evading brute-force protection mechanisms.