CVE-2016-0757
OpenStack Image Service (Glance) vulnerable to Improper Access Control
CVE-2016-0757 is a medium vulnerability (CVSS 4.3) in Openstack Image Registry And Delivery Service \(glance\), published April 13, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.48%, the 73rd percentile. Fixed in glance 11.0.2.
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
- Record
CVE-2016-0757- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
- Record
CVE-2016-0757- Updated
- 2026-11-02
EUVDEUVD-2022-2682 No score
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
- Record
EUVD-2022-2682- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5xrj-ghhp-hx7p
OpenStack Image Service (Glance) vulnerable to Improper Access Control
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
- Record
GHSA-5xrj-ghhp-hx7p- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
- Record
CVE-2016-0757- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-0757
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
- Record
DEBIAN-CVE-2016-0757- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-5xrj-ghhp-hx7p
OpenStack Image Service (Glance) vulnerable to Improper Access Control
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
- Record
GHSA-5xrj-ghhp-hx7p- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVPYSEC-2026-811
OpenStack Image Service (Glance) vulnerable to Improper Access Control
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
- Record
PYSEC-2026-811- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-0757
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
- Record
UBUNTU-CVE-2016-0757- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUSN-3446-1 No score
glance vulnerabilities
Hemanth Makkapati discovered that OpenStack Glance incorrectly handled access restrictions. A remote authenticated user could use this issue to change the status of images, contrary to access restrictions. (CVE-2015-5251)
Mike Fedosin and Alexei Galkin discovered that OpenStack Glance incorrectly handled the storage quota. A remote authenticated user could use this issue to consume disk resources, leading to a denial of service. (CVE-2015-5286)
Erno Kuvaja discovered that OpenStack Glance incorrectly handled the show_multiple_locations option. When show_multiple_locations is enabled, a remote authenticated user could change an image status and upload new image data. (CVE-2016-0757)
- Record
USN-3446-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glancePyPI |
11.0.0 up to 11.0.2 | 11.0.2 |
glanceDebian:12 |
before 2:12.0.0-1 | 2:12.0.0-1 |
glanceDebian:13 |
before 2:12.0.0-1 | 2:12.0.0-1 |
glanceDebian:14 |
before 2:12.0.0-1 | 2:12.0.0-1 |
openstack-glanceRed Hat:openstack:6::el7 |
before 0:2014.2.3-4.el7ost | 0:2014.2.3-4.el7ost |
openstack-glance-docRed Hat:openstack:6::el7 |
before 0:2014.2.3-4.el7ost | 0:2014.2.3-4.el7ost |
python-glanceRed Hat:openstack:6::el7 |
before 0:2014.2.3-4.el7ost | 0:2014.2.3-4.el7ost |
openstack-glanceRed Hat:openstack:7::el7 |
before 0:2015.1.2-2.el7ost | 0:2015.1.2-2.el7ost |
openstack-glance-docRed Hat:openstack:7::el7 |
before 0:2015.1.2-2.el7ost | 0:2015.1.2-2.el7ost |
python-glanceRed Hat:openstack:7::el7 |
before 0:2015.1.2-2.el7ost | 0:2015.1.2-2.el7ost |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-glanceRed Hat:openstack:5::el7 |
before 0:2014.1.5-5.el7ost | 0:2014.1.5-5.el7ost |
openstack-glance-docRed Hat:openstack:5::el7 |
before 0:2014.1.5-5.el7ost | 0:2014.1.5-5.el7ost |
python-glanceRed Hat:openstack:5::el7 |
before 0:2014.1.5-5.el7ost | 0:2014.1.5-5.el7ost |
openstack-glanceRed Hat:openstack:5::el6 |
before 0:2014.1.5-5.el6ost | 0:2014.1.5-5.el6ost |
openstack-glance-docRed Hat:openstack:5::el6 |
before 0:2014.1.5-5.el6ost | 0:2014.1.5-5.el6ost |
python-glanceRed Hat:openstack:5::el6 |
before 0:2014.1.5-5.el6ost | 0:2014.1.5-5.el6ost |
glanceUbuntu:14.04:LTS |
before 1:2014.1.5-0ubuntu1.1, plus listed versions 1:2013.2~rc2-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b3-0ubuntu2 Show 9 moreShow less1:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu21:2014.1.2-0ubuntu11:2014.1.2-0ubuntu1.11:2014.1.3-0ubuntu11:2014.1.4-0ubuntu21:2014.1.5-0ubuntu1 |
1:2014.1.5-0ubuntu1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
rhn.redhat.com/errata/RHSA-2016-0309.html
securityfocus.com/bid/82696
security.openstack.org/ossa/OSSA-2016-006.html
nvd.nist.gov/vuln/detail/CVE-2016-0757
access.redhat.com/errata/RHSA-2016:0309
Show 19 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1302607
web.archive.org/web/20210123081823/https://www.securityfocus.com/bid/82696
github.com/advisories/GHSA-5xrj-ghhp-hx7p
security-tracker.debian.org/tracker/CVE-2016-0757
opendev.org/openstack/glance
pypi.org/project/glance
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0309.json
cve.org/CVERecord?id=CVE-2016-0757
ubuntu.com/security/CVE-2016-0757