CVE-2026-24708: [OSSA-2026-002] OpenStack Nova: calls qemu-img without format strictions for size (CVE-2026-24708)
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with usecowimages=False) are affected.
Other sources
Unconstrained disk format handling vulnerability in OpenStack Nova when invoking the qemu-img utility. The flaw occurs because Nova does not strictly enforce the expected disk image format before calling qemu-img. An authenticated attacker can write a crafted QCOW2 header to a raw ephemeral or root disk. When Nova later performs operations such as instance resize, qemu-img interprets the disk as QCOW2 and overwrites arbitrary files on the compute host that Nova has write access to. This can be exploited without additional privileges or user interaction, allowing attackers to destroy other users’ data, corrupt Nova-managed files, or cause denial of service on the compute node.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Novato a version that resolves this vulnerability.Fixed in 30.2.2 - Upgrade
Upgrade
OpenStack Novato a version that resolves this vulnerability.Fixed in 31.2.1 - Upgrade
Upgrade
OpenStack Novato a version that resolves this vulnerability.Fixed in 32.1.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch OSSA-2026-002
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24708?
CVE-2026-24708 is considered a critical vulnerability due to the potential for denial of service or execution of arbitrary code.
How do I fix CVE-2026-24708?
To fix CVE-2026-24708, upgrade OpenStack Nova to version 30.2.2, 31.2.1, or 32.1.1 or later.
Who is affected by CVE-2026-24708?
CVE-2026-24708 affects all versions of OpenStack Nova prior to the specified patched versions.
What causes CVE-2026-24708?
CVE-2026-24708 is caused by inadequate restrictions when calling qemu-img, allowing the use of a malicious QCOW header.
Can CVE-2026-24708 be exploited remotely?
Yes, CVE-2026-24708 can be exploited remotely by authenticated users with access to modify snapshots.