CVE-2026-24708
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
- Score
- CVSS 3.1 8.2 High
- Status
- Deferred - cve@mitre.org
- Published
- 2026-02-18
- Last modified
- 2026-09-11
- Weaknesses
- CWE-669, CWE-73
Affected products
References
- https://bugs.launchpad.net/nova/+bug/2137507
- https://www.openwall.com/lists/oss-security/2026/02/17/7
- https://lists.debian.org/debian-lts-announce/2026/02/msg00025.html
- https://access.redhat.com/errata/RHSA-2026:54757
- https://access.redhat.com/errata/RHSA-2026:66401
- https://access.redhat.com/errata/RHSA-2026:7884
- https://access.redhat.com/security/cve/CVE-2026-24708
- https://bugzilla.redhat.com/show_bug.cgi?id=2430312
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24708.json
