Attack Chain

1. The attacker identifies a vulnerable Glance instance (version 0.8.5 or earlier) that has the server's proxied option enabled.
2. The attacker crafts HTTP POST requests targeting the Glance authentication endpoint, typically /auth or a similar path.
3. In each authentication request, the attacker includes an X-Forwarded-For HTTP header.
4. For every subsequent login attempt, the attacker modifies the leftmost IP address value within the X-Forwarded-For header to an arbitrary, distinct value.
5. Along with the manipulated X-Forwarded-For header, the attacker submits a guessed username and password combination.
6. The Glance authentication handler, when configured in a proxied environment, incorrectly interprets each unique X-Forwarded-For value as a distinct originating IP address.
7. This manipulation prevents the per-IP failed-login counter from incrementing beyond the lockout threshold for any single perceived IP, thereby bypassing brute-force lockout mechanisms.
8. The attacker can continue to guess credentials indefinitely against the authentication endpoint until a valid credential pair is discovered, leading to unauthorized access.

Impact

Successful exploitation of CVE-2026-63770 allows attackers to perform unlimited credential guessing against Glance authentication endpoints, effectively bypassing built-in brute-force protection mechanisms. This can lead to unauthorized access to the Glance application, which is a key component of OpenStack for managing virtual machine images. Compromise of Glance could grant attackers control over the virtual machine image repository, allowing them to inject malicious images, tamper with existing ones, or gain a foothold into the broader OpenStack environment, potentially leading to unauthorized data access, service disruption, or further system compromise. While the NVD entry does not specify observed exploitation or victim count, the ability to defeat brute-force protections for a critical component like an image service poses a significant risk for organizations using vulnerable versions.

Recommendation

• Patch CVE-2026-63770 by upgrading Glance to a version greater than 0.8.5 immediately.
• Review web server, load balancer, and proxy configurations to ensure X-Forwarded-For headers are correctly handled, sanitized, and validated, especially when Glance's proxied option is enabled.
• Deploy the provided Sigma rule to detect suspicious X-Forwarded-For header manipulation attempts against authentication endpoints.
• Implement strong authentication policies, such as multi-factor authentication (MFA), for all user accounts accessing Glance and other OpenStack components to mitigate the impact of compromised credentials.