YAOOK Security Advisory for glance CVE-2026-71196, CVE-2026-71197, CVE-2026-71198

What are CVE-2026-71196, CVE-2026-71197 and CVE-2026-71198 and how do they affect YAOOK?

Sergey Kanibor and Abhishek Kekane reported three related SSRF vulnerabilities in Glance’s web-download import method and HTTP image location APIs. The web-download import ships with insecure default filtering that permits authenticated users to fetch arbitrary internal URLs including cloud metadata endpoints. Additionally, the URI validator does not resolve DNS before applying host filters, enabling bypass via attacker-controlled domains and DNS rebinding. The HTTP image location API lacks host filtering entirely when the HTTP store is enabled. Fetched content is stored as image data and can be downloaded, turning blind SSRF into full-read exfiltration

Is my cluster vulnerable?

The following images are vulnerable:
  • glance images before 1.1.165
  • yaook release prior to 3.4.0
If this image is used in your cluster for the glance deployment, the cluster is vulnerable.
 
The fixed image has been built in a private pipeline which has been published alongside this advisory to prove the image provenance.

Upgrading

A new stable release will be published according to the release cycle and hotfix releases will be produced starting now. You can upgrade to that release simply by updating your operators.
 
However, we recommend adding a YAOOK_OP_VERSIONS_OVERRIDE variable to your glance operator container to pull the image before the YAOOK comprehensive release is ready.
 
The best way to do this is to set the following in the values.yaml of your glance-operator (make sure to merge this correctly with an existing values.yaml, if you have that).
operator:
    extraEnv:
    - name: YAOOK_OP_VERSIONS_OVERRIDE
    value: |
        {
            "registry.yaook.cloud/yaook/glance-2024.1": "registry.yaook.cloud/yaook/glance-2024.1:1.1.165",
            "registry.yaook.cloud/yaook/glance-2024.2": "registry.yaook.cloud/yaook/glance-2024.2:1.1.165",
            "registry.yaook.cloud/yaook/glance-2025.1": "registry.yaook.cloud/yaook/glance-2025.1:1.1.165",
            "registry.yaook.cloud/yaook/glance-2025.2": "registry.yaook.cloud/yaook/glance-2025.2:1.1.165",
            "registry.yaook.cloud/yaook/glance-2026.1": "registry.yaook.cloud/yaook/glance-2026.1:1.1.165"
        }
If you are not using Helm, you can add the environment variable to the env section of your glance-operator’s Deployment’s pod template.
de_DE_formal
de_DE_formal