Skip to content
Fencer Vulns
high 8.2

CVE-2026-24708 json

OpenStack Nova calls qemu-img without format restrictions for resize

published 2026-02-18 8 mo ago modified 2026-09-11 58 d ago also GHSA-m4f3-qp2w-gwh6 , PYSEC-2026-2685 , EUVD-2026-7738

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits
0
none known

Summary

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.

Patch / fix

  • OpenStack Nova 30.2.2, 31.2.1, 32.1.1
  • Red Hat Red Hat OpenStack Platform 16.2 1:20.6.2-2.20260317135026.8a24acd.el8ost
  • Red Hat Red Hat OpenStack Platform 17.1 for RHEL 9 0:0.2.1-6.el9ost, 0:0.8.37-17.1.20260107141051.05dd1b2.el9ost, 0:1.2.0-1.4.el9ost, 0:1.8.0-17.1.20260114160833.0e94611.el9ost, 0:1.9.1-17.1.20260318160829.0e9a6f2.el9ost, 0:2.27.1-17.1.20260806131309.16dbcae.el9ost, 0:3.4.26-9.6.el9ost, 0:7.1.1-17.1.20260803104219.0211fa9.el9ost, 0:11.0.1-17.1.20260306080955.63fee2c.el9ost, 0:14.2.1-17.1.20260803103231.61d7bd7.el9ost, 0:14.2.3-17.1.20260206090839.40278e1.el9ost, 0:14.3.1-17.1.20260803105013.e7c7ce3.el9ost, 0:17.1-20260901.1.el9ost, 0:24.3.4.2-7.el9ost, 1:16.1.1-17.1.20260713101101.edc6d60.el9ost, 1:17.1.1-17.1.20260721220909.c31db88.el9ost, 1:18.2.2-17.1.20260702111621.f6b44fc.el9ost, 1:18.6.1-17.1.20260810120959.85ff760.el9ost, 1:19.0.2-17.1.20260630150819.54dd95d.el9ost, 1:23.2.3-17.1.20260810140853.2ace99d.el9ost
  • Red Hat Red Hat OpenStack Services on OpenShift 18.0 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
  • nova Debian 12 2:26.2.2-1~deb12u4
  • nova Debian 13 2:31.0.0-6+deb13u2
  • nova Debian 14 2:32.1.0-7

debian advisories DEBIAN-CVE-2026-24708

  • nova Ubuntu 22.04 LTS 3:25.2.1-0ubuntu2.10
  • nova Ubuntu 24.04 LTS 3:29.2.0-0ubuntu1.3
  • nova Ubuntu 25.10 3:32.0.0-0ubuntu1.1

ubuntu advisories UBUNTU-CVE-2026-24708

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • etcd openstack 17.1 3.4.26-9.6.el9ost
  • erlang openstack 17.1 24.3.4.2-7.el9ost
  • erlang-ssl openstack 17.1 24.3.4.2-7.el9ost
  • erlang-asn1 openstack 17.1 24.3.4.2-7.el9ost
  • erlang-erts openstack 17.1 24.3.4.2-7.el9ost
  • erlang-sasl openstack 17.1 24.3.4.2-7.el9ost
  • erlang-snmp openstack 17.1 24.3.4.2-7.el9ost
  • erlang-eldap openstack 17.1 24.3.4.2-7.el9ost

red hat advisories RHSA-2026:66401RHSA-2026:54757RHSA-2026:7884

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-24708 updated cvss 7.1

openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova

  • Red Hat OpenStack Platform 16.2 rhosp-rhel8/openstack-nova-compute Red Hat OpenStack Platform 17.1 rhosp-rhel8/openstack-nova-compute, rhosp-rhel9/openstack-nova-compute Red Hat OpenStack Platform 18.0 rhosp-rhel9/openstack-nova-compute
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 13.0 - ELS python-nova 17.0.13-43.el7ost, openstack-nova 17.0.13-43.el7ost, python-nova-tests 17.0.13-43.el7ost, openstack-nova-api 17.0.13-43.el7ost, openstack-nova-cells 17.0.13-43.el7ost, openstack-nova-common 17.0.13-43.el7ost, +10 more
    fixed: vendor fix RHSA-2026:94039
  • Red Hat OpenStack Platform 16.2 python3-nova 20.6.2-2.20260317135026.8a24acd.el8ost, openstack-nova 20.6.2-2.20260317135026.8a24acd.el8ost, openstack-nova-api 20.6.2-2.20260317135026.8a24acd.el8ost, openstack-nova-common 20.6.2-2.20260317135026.8a24acd.el8ost, openstack-nova-compute 20.6.2-2.20260317135026.8a24acd.el8ost, openstack-nova-console 20.6.2-2.20260317135026.8a24acd.el8ost, +6 more
    fixed: vendor fix RHSA-2026:54757
  • Red Hat OpenStack Platform 17.1 etcd 3.4.26-9.6.el9ost, erlang 24.3.4.2-7.el9ost, erlang-ssl 24.3.4.2-7.el9ost, erlang-asn1 24.3.4.2-7.el9ost, erlang-erts 24.3.4.2-7.el9ost, erlang-sasl 24.3.4.2-7.el9ost, +100 more
    fixed: vendor fix RHSA-2026:66401
  • Red Hat OpenStack Services on OpenShift 18.0 python3-nova 27.5.2-18.0.20260312122217.c1c6d67.el9ost, openstack-nova 27.5.2-18.0.20260312122217.c1c6d67.el9ost, openstack-nova-api 27.5.2-18.0.20260312122217.c1c6d67.el9ost, openstack-nova-common 27.5.2-18.0.20260312122217.c1c6d67.el9ost, openstack-nova-compute 27.5.2-18.0.20260312122217.c1c6d67.el9ost, openstack-nova-conductor 27.5.2-18.0.20260312122217.c1c6d67.el9ost, +5 more
    fixed: vendor fix RHSA-2026:7884
  • Red Hat OpenStack Platform 13.0 - ELS python-webob 1.7.2-2.el7ost, openstack-heat 10.0.3-21.el7ost, python-keystone 13.0.4-10.el7ost, openstack-heat-api 10.0.3-21.el7ost, openstack-keystone 13.0.4-10.el7ost, openstack-heat-common 10.0.3-21.el7ost, +4 more Red Hat OpenStack Platform 16.2 etcd 3.3.23-22.el8ost, erlang 23.3.4.18-2.el8ost, python-pyasn1 0.4.6-4.el8ost, erlang-ssl 23.3.4.18-2.el8ost, python3-pyasn1 0.4.6-4.el8ost, erlang-asn1 23.3.4.18-2.el8ost, +71 more
    not affected: vulnerable code not present
  • Red Hat OpenStack Platform 17.1 rhosp12/openstack-nova-compute
    not affected: component not present
  • Red Hat OpenStack Platform 18.0 rhosp12/openstack-nova-compute, rhoso/openstack-nova-compute-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
8 mo ago

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
CISA ADP 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
OSV 3.1 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
GitHub 3.1 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi nova
>=32.0.0.0rc1, <=32.1.0
>=31.0.0.0rc1, <=31.2.0
<=30.2.1
 no fix listed

Affected products

  • OpenStack Nova
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1 for RHEL 9
  • Red Hat Red Hat OpenStack Services on OpenShift 18.0
  • Red Hat Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0

Classification

Weakness
  • CWE-669 Incorrect Resource Transfer Between Spheres
  • CWE-73 External Control of File Name or Path

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.