Junglewise Threat Intelligence

CVE-2026-24708: OpenStack Nova host data destruction via unsafe qemu-img resize

CVE-2026-24708 · Severity: high · CVSS 8.2 · Published 2026-02-18

Technologies: nova (PyPI). Vendors: Red Hat, PyPI, OpenStack.

Executive brief

OpenStack Nova is a cloud computing service used to manage and provision virtual machines. A security vulnerability has been identified where a malicious user can corrupt or destroy data on the underlying physical server by manipulating virtual disk headers. This occurs when the system performs a disk resize operation, potentially leading to a total loss of data for other users on the same physical host or a complete service outage.

Technical details

A vulnerability exists in OpenStack Nova's Flat image backend (typically when use_cow_images=False) due to improper validation of disk formats. An authenticated attacker can write a malicious QCOW header to a root or ephemeral disk. When a resize operation is subsequently triggered, Nova calls the qemu-img utility without explicit format restrictions. This causes qemu-img to misinterpret the disk format based on the malicious header, leading to an unsafe resize operation that can overwrite or destroy arbitrary files on the compute host that the Nova process has permission to access. Patches are available in Nova versions 30.2.2, 31.2.1, and 32.1.1.

Affected products

  • OpenStack Nova < 30.2.2, 31.x < 31.2.1, 32.x < 32.1.1
  • Red Hat Red Hat OpenStack Services on OpenShift 18.0
  • Red Hat Red Hat OpenStack Platform 13, 16.2, 17.1, 18.0

Timeline

  • 2026-01-16: disclosed: Initial report by Dan Smith from Red Hat
  • 2026-02-17: advisory: OpenStack Security Advisory OSSA-2026-002 released
  • 2026-02-18: disclosed: CVE-2026-24708 published
  • 2026-04-29: patched: Red Hat released security updates (RHSA-2026:7884)

References

Related threats