What’s Vulnerable › Vulnerabilities

CVE-2026-24708

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-18 · updated 2026-09-11
• Weakness: CWE-669

Description

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.

Affected products

• OpenStack Nova: before 30.2.2; from 31.0.0 before 31.2.1; from 32.0.0 before 32.1.1 — fixed in 30.2.2, 31.2.1, 32.1.1

How to fix

Upgrade to a fixed version: OpenStack Nova 30.2.2, 31.2.1, 32.1.1. Check the vendor advisory for mitigations.

References

• https://bugs.launchpad.net/nova/+bug/2137507
• https://www.openwall.com/lists/oss-security/2026/02/17/7
• https://lists.debian.org/debian-lts-announce/2026/02/msg00025.html
• https://access.redhat.com/errata/RHSA-2026:54757
• https://access.redhat.com/errata/RHSA-2026:66401
• https://access.redhat.com/errata/RHSA-2026:7884
• https://access.redhat.com/security/cve/CVE-2026-24708
• https://bugzilla.redhat.com/show_bug.cgi?id=2430312
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24708.json

Get alerted when CVE-2026-24708 or the next vulnerability affects your stack