CVE-2026-24708

EUVD-2026-7738
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
8.2 HIGH
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 29.7%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat OpenStack Platform 16.2
1:20.6.2-2.20260317135026.8a24acd.el8ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:1.2.0-1.4.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:1.9.1-17.1.20260318160829.0e9a6f2.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:0.2.1-6.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:24.3.4.2-7.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:3.4.26-9.6.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:17.1-20260901.1.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
1:18.2.2-17.1.20260702111621.f6b44fc.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
1:16.1.1-17.1.20260713101101.edc6d60.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
1:17.1.1-17.1.20260721220909.c31db88.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:7.1.1-17.1.20260803104219.0211fa9.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
1:19.0.2-17.1.20260630150819.54dd95d.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
1:18.6.1-17.1.20260810120959.85ff760.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
1:23.2.3-17.1.20260810140853.2ace99d.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:0.8.37-17.1.20260107141051.05dd1b2.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:2.27.1-17.1.20260806131309.16dbcae.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:14.3.1-17.1.20260803105013.e7c7ce3.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:14.2.1-17.1.20260803103231.61d7bd7.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:11.0.1-17.1.20260306080955.63fee2c.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:14.2.3-17.1.20260206090839.40278e1.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:1.8.0-17.1.20260114160833.0e94611.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
1:19.4.1-17.1.20260630130603.9b1a13e.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:2.5.1-17.1.20260225150839.5f1cee6.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:4.3.4-17.1.20260324150947.cf69f92.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:12.7.3-17.1.20260701150916.5d6fd1a.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:4.1.1-17.1.20260326121047.bbe5d5a.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:1.9.4-17.1.20260304101059.65d02f0.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9
0:3.3.1-17.1.20260603190918.8debef3.el9ost ≤
𝑥
< *
ADP
Red HatRed Hat OpenStack Services on OpenShift 18.0
1:27.5.2-18.0.20260312122217.c1c6d67.el9ost ≤
𝑥
< *
ADP
openstacknova
𝑥
< 30.2.2
CNA
openstacknova
31.0.0 ≤
𝑥
< 31.2.1
CNA
openstacknova
32.0.0 ≤
𝑥
< 32.1.1
CNA
Debian logo
Debian Releases
Debian Product
Codename
nova
bookworm
2:26.2.2-1~deb12u4
fixed
bookworm (security)
2:26.2.2-1~deb12u4
fixed
forky
2:33.0.2-1
fixed
sid
2:34.0.0~rc1-3
fixed
trixie
2:31.0.0-6+deb13u2
fixed
trixie (security)
2:31.0.0-6+deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nova
bionic
needs-triage
focal
needs-triage
jammy
Fixed 3:25.2.1-0ubuntu2.10
released
noble
Fixed 3:29.2.0-0ubuntu1.3
released
questing
Fixed 3:32.0.0-0ubuntu1.1
released
resolute
not-affected
xenial
needs-triage
Common Weakness Enumeration
References
https://bugs.launchpad.net/nova/+bug/2137507
https://www.openwall.com/lists/oss-security/2026/02/17/7
https://lists.debian.org/debian-lts-announce/2026/02/msg00025.html
https://access.redhat.com/errata/RHSA-2026:54757
https://access.redhat.com/errata/RHSA-2026:66401
https://access.redhat.com/errata/RHSA-2026:7884
https://access.redhat.com/security/cve/CVE-2026-24708
https://bugzilla.redhat.com/show_bug.cgi?id=2430312
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24708.json