OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

published 2024-07-24 2 y ago modified 2026-07-07 4 mo ago also GHSA-rm86-h44c-2r2m , PYSEC-2026-1709 , EUVD-2024-2412

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 61%
public exploits: 0; none known

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

Patch / fix

fixed in 1 distros 2

openstack nova 27.4.1, 28.2.1, 29.1.1

ubuntu red hat

nova Ubuntu 20.04 LTS 2:21.2.4-0ubuntu2.11
nova Ubuntu 22.04 LTS 3:25.2.1-0ubuntu2.6
nova Ubuntu 24.04 LTS 3:29.0.1-0ubuntu1.4

ubuntu advisories UBUNTU-CVE-2024-40767

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python3-nova openstack 16.1 1:20.4.1-1.20221005193235.el8ost
openstack-nova openstack 16.1 1:20.4.1-1.20221005193235.el8ost
openstack-nova-api openstack 16.1 1:20.4.1-1.20221005193235.el8ost
openstack-nova-common openstack 16.1 1:20.4.1-1.20221005193235.el8ost
openstack-nova-compute openstack 16.1 1:20.4.1-1.20221005193235.el8ost
openstack-nova-console openstack 16.1 1:20.4.1-1.20221005193235.el8ost
openstack-nova-conductor openstack 16.1 1:20.4.1-1.20221005193235.el8ost
openstack-nova-migration openstack 16.1 1:20.4.1-1.20221005193235.el8ost

red hat advisories RHSA-2024:5113 RHSA-2024:5097 RHSA-2024:5083

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-40767 updated 2026-08-07 cvss 5.5

openstack-nova: Regression VMDK/qcow arbitrary file access

Red Hat OpenStack Platform 16.1 python3-nova 20.4.1-1.20221005193235.el8ost, openstack-nova 20.4.1-1.20221005193235.el8ost, openstack-nova-api 20.4.1-1.20221005193235.el8ost, openstack-nova-common 20.4.1-1.20221005193235.el8ost, openstack-nova-compute 20.4.1-1.20221005193235.el8ost, openstack-nova-console 20.4.1-1.20221005193235.el8ost, +6 more
fixed: vendor fix RHSA-2024:5113
Red Hat OpenStack Platform 16.2 python3-nova 20.6.2-2.20230814165229.el8ost, openstack-nova 20.6.2-2.20230814165229.el8ost, openstack-nova-api 20.6.2-2.20230814165229.el8ost, openstack-nova-common 20.6.2-2.20230814165229.el8ost, openstack-nova-compute 20.6.2-2.20230814165229.el8ost, openstack-nova-console 20.6.2-2.20230814165229.el8ost, +6 more
fixed: vendor fix RHSA-2024:5097
Red Hat OpenStack Platform 17.1 python3-nova 23.2.3-17.1.20231018123755.el8ost, python3-nova 23.2.3-17.1.20231018130829.el9ost, openstack-nova 23.2.3-17.1.20231018123755.el8ost, openstack-nova 23.2.3-17.1.20231018130829.el9ost, openstack-nova-api 23.2.3-17.1.20231018130829.el9ost, openstack-nova-common 23.2.3-17.1.20231018123755.el8ost, +10 more
fixed: vendor fix RHSA-2024:5082
Red Hat OpenStack Platform 18.0 openstack-nova
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-07-24)

Exploit prediction

0.95% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

launchpad.net https://launchpad.net/bugs/2071734 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
OSV	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	nova	<=27.4.0 >=28.0.0, <=28.2.0 >=29.0.0, <=29.1.0	no fix listed

Classification

Weakness

CWE-552 Files or Directories Accessible to External Parties
CWE-436 Interpretation Conflict

References

launchpad.net /bugs/2071734
web, exploit, issue-tracking
security.openstack.org
web, vendor-advisory
security.openstack.org /ossa/OSSA-2024-002.html
web, vendor-advisory
openwall.com /lists/oss-security/2024/07/23/2
web, mailing-list
lists.debian.org /debian-lts-announce/2024/09/msg00017.html
web
nvd.nist.gov /vuln/detail/CVE-2024-40767
advisory
github.com /openstack/nova
package
review.opendev.org /c/openstack/nova/+/924731
web
pypi.org /project/nova
package
github.com /advisories/GHSA-rm86-h44c-2r2m
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary