GHSA-m4f3-qp2w-gwh6 CVE-2026-24708 PYSEC-2026-2685
OpenStack Nova calls qemu-img without format restrictions for resize
- Severity
- 8.2 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.42%
- Chance of exploitation in the next 30 days. Higher than 35.93% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-669 Incorrect Resource Transfer Between Spheres
- Fix
- None yet
- No fixed version published
Description
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| nova | >= 32.0.0.0rc1, <= 32.1.0 |
No fix yet |
| nova | >= 31.0.0.0rc1, <= 31.2.0 |
No fix yet |
| nova | <= 30.2.1 |
No fix yet |
| nova | <= 30.2.1>= 31.0.0.0rc1, <= 31.2.0>= 32.0.0.0rc1, <= 32.1.0 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 8.2
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Weakness
CWE-669: Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
References
Advisories
Packages
Other links
- github.com/openstack/nova/commit/3eba22ff09c81a61750fbb4882e5f1f01a20fdf5
- bugs.launchpad.net/nova/+bug/2137507
- lists.debian.org/debian-lts-announce/2026/02/msg00025.html
- openwall.com/lists/oss-security/2026/02/17/7
- access.redhat.com/errata/RHSA-2026:54757
- access.redhat.com/errata/RHSA-2026:66401
- access.redhat.com/errata/RHSA-2026:7884
- access.redhat.com/security/cve/CVE-2026-24708
- bugzilla.redhat.com/show_bug.cgi
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24708.json
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-mfg3-p6m3-gjgr OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints | High | Also affects nova |
| GHSA-rm86-h44c-2r2m OpenStack Nova vulnerable to unauthorized access to potentially sensitive data | Medium | Also affects nova |
| GHSA-r4v4-w9pv-6fph OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access | Medium | Also affects nova |
| GHSA-7h75-hwxx-qpgc OpenStack Cinder, glance, and Nova vulnerable to Path Traversal | Medium | Also affects nova |
| GHSA-v725-c588-h936 OpenStack Nova Changing vnic_type breaks compute service restart | Low | Also affects nova |
| GHSA-22jm-4hxw-35jf OpenStack Nova can leak consoleauth token into log files | Low | Also affects nova |
| GHSA-43cm-73px-5v4m OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors | Low | Also affects nova |
| GHSA-j6xh-q826-55jw OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack | Medium | Also affects nova |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor