CVE-2026-24708: OpenStack Nova host data destruction via unsafe qemu-img resize

CVE-2026-24708 · Severity: high · CVSS 8.2 · Published 2026-02-18

OpenStack Nova is a cloud computing service used to manage and provision virtual machines. A security vulnerability has been identified where a malicious user can corrupt or destroy data on the underlying physical server by manipulating virtual disk headers. This occurs when the system performs a disk resize operation, potentially leading to a total loss of data for other users on the same physical host or a complete service outage.

Technologies: nova (PyPI). Vendors: PyPI, Red Hat.

Quick answers

Is CVE-2026-24708 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-24708 being exploited in the wild.
How severe is CVE-2026-24708?
High severity, with a CVSS score of 8.2, published 18 February 2026.
Which products and versions are affected?
nova (PyPI) ECOSYSTEM:introduced=0,last_affected=30.2.1,introduced=31.0.0.0rc1,last_affected=31.2.0,introduced=32.0.0.0rc1,last_affected=32.1.0, ECOSYSTEM:introduced=32.0.0.0rc1,last_affected=32.1.0; Red Hat OpenStack Services on OpenShift 18.0.
Is there a fix for CVE-2026-24708?
A patch was published on 2026-04-29: Red Hat released security updates (RHSA-2026:7884) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24708 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-24708?
Check whether you run nova (PyPI) or Red Hat OpenStack Services on OpenShift at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in OpenStack Nova's Flat image backend (typically when use_cow_images=False) due to improper validation of disk formats. An authenticated attacker can write a malicious QCOW header to a root or ephemeral disk. When a resize operation is subsequently triggered, Nova calls the qemu-img utility without explicit format restrictions. This causes qemu-img to misinterpret the disk format based on the malicious header, leading to an unsafe resize operation that can overwrite or destroy arbitrary files on the compute host that the Nova process has permission to access. Patches are available in Nova versions 30.2.2, 31.2.1, and 32.1.1.

Affected products

  • OpenStack Nova < 30.2.2, 31.x < 31.2.1, 32.x < 32.1.1
  • Red Hat Red Hat OpenStack Services on OpenShift 18.0
  • Red Hat Red Hat OpenStack Platform 13, 16.2, 17.1, 18.0

Identifiers

  • CVE-2026-24708
  • GHSA-m4f3-qp2w-gwh6
  • PYSEC-2026-2685

Timeline

  • 2026-01-16: disclosed: Initial report by Dan Smith from Red Hat
  • 2026-02-17: advisory: OpenStack Security Advisory OSSA-2026-002 released
  • 2026-02-18: disclosed: CVE-2026-24708 published
  • 2026-04-29: patched: Red Hat released security updates (RHSA-2026:7884)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.