{ "dataType": "CVE_RECORD", "cveMetadata": { "state": "PUBLISHED", "cveId": "CVE-2026-24708", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-08-14T12:04:27.290Z", "dateReserved": "2026-01-24T00:00:00.000Z", "datePublished": "2026-02-18T00:00:00.000Z" }, "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Nova", "vendor": "OpenStack", "versions": [ { "lessThan": "30.2.2", "status": "affected", "version": "0", "versionType": "semver" }, { "lessThan": "31.2.1", "status": "affected", "version": "31.0.0", "versionType": "semver" }, { "lessThan": "32.1.1", "status": "affected", "version": "32.0.0", "versionType": "semver" } ] } ], "descriptions": [ { "lang": "en", "value": "An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-669", "description": "CWE-669 Incorrect Resource Transfer Between Spheres", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-02-18T17:03:53.469Z" }, "references": [ { "url": "https://bugs.launchpad.net/nova/+bug/2137507" }, { "url": "https://www.openwall.com/lists/oss-security/2026/02/17/7" } ], "x_generator": { "engine": "enrichogram 0.0.1" }, "metrics": [ { "cvssV3_1": { "version": "3.1", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H" } } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*", "versionEndExcluding": "30.2.2" }, { "vulnerable": true, "criteria": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*", "versionStartIncluding": "31.0.0", "versionEndExcluding": "31.2.1" }, { "vulnerable": true, "criteria": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*", "versionStartIncluding": "32.0.0", "versionEndExcluding": "32.1.1" } ] } ] } ] }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-02-19T19:07:53.345297Z", "id": "CVE-2026-24708", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T19:08:07.846Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00025.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-21T04:31:45.294Z" } }, { "affected": [ { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openstack:16.2::el8" ], "defaultStatus": "affected", "packageName": "openstack-nova", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1:20.6.2-2.20260317135026.8a24acd.el8ost", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openstack:18.0::el9" ], "defaultStatus": "affected", "packageName": "openstack-nova", "product": "Red Hat OpenStack Services on OpenShift 18.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1:27.5.2-18.0.20260312122217.c1c6d67.el9ost", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openstack:13" ], "defaultStatus": "affected", "packageName": "rhosp13/openstack-nova-compute", "product": "Red Hat OpenStack Platform 13 (Queens)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openstack:16.2" ], "defaultStatus": "unaffected", "packageName": "rhosp12/openstack-nova-compute", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openstack:16.2" ], "defaultStatus": "affected", "packageName": "rhosp-rhel8/openstack-nova-compute", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openstack:16.2" ], "defaultStatus": "unaffected", "packageName": "rhosp-rhel9/openstack-nova-compute", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openstack:17.1" ], "defaultStatus": "affected", "packageName": "openstack-nova", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openstack:17.1" ], "defaultStatus": "unaffected", "packageName": "rhosp12/openstack-nova-compute", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openstack:17.1" ], "defaultStatus": "affected", "packageName": "rhosp-rhel8/openstack-nova-compute", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openstack:17.1" ], "defaultStatus": "affected", "packageName": "rhosp-rhel9/openstack-nova-compute", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openstack:18.0" ], "defaultStatus": "unaffected", "packageName": "rhoso/openstack-nova-compute-rhel9", "product": "Red Hat OpenStack Platform 18.0", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openstack:18.0" ], "defaultStatus": "unaffected", "packageName": "rhosp12/openstack-nova-compute", "product": "Red Hat OpenStack Platform 18.0", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openstack:18.0" ], "defaultStatus": "affected", "packageName": "rhosp-rhel9/openstack-nova-compute", "product": "Red Hat OpenStack Platform 18.0", "vendor": "Red Hat" } ], "datePublic": "2026-02-17T15:00:00.000Z", "descriptions": [ { "lang": "en", "value": "A flaw in OpenStack Nova’s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw disk and trigger destructive behavior during instance operations such as resize." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-73", "description": "External Control of File Name or Path", "lang": "en", "type": "CWE" } ] } ], "references": [ { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2026-24708" }, { "name": "RHBZ#2430312", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430312" }, { "tags": [ "x_sadp-csaf-vex" ], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24708.json" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:54757" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:7884" } ], "solutions": [ { "lang": "en", "value": "RHSA-2026:54757: Red Hat OpenStack Platform 16.2" }, { "lang": "en", "value": "RHSA-2026:7884: Red Hat OpenStack Services on OpenShift 18.0" } ], "timeline": [ { "lang": "en", "time": "2026-01-16T06:29:23.249Z", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2026-02-17T15:00:00.000Z", "value": "Made public." } ], "title": "openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova", "workarounds": [ { "lang": "en", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ], "x_adpType": "supplier", "x_generator": { "engine": "sadp-cli 1.0.0" }, "providerMetadata": { "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-14T12:04:27.290Z" } } ] }, "dataVersion": "5.2" }