CVE-2026-24708: CWE-669 Incorrect Resource Transfer Between Spheres in OpenStack Nova
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
AI Analysis
Technical Summary
OpenStack Nova versions before 30.2.2, 31.2.1, and 32.1.1 contain a vulnerability (CVE-2026-24708) where the Flat image backend, typically configured with use_cow_images=False, calls the qemu-img utility without format restrictions during image resize operations. An authenticated user can exploit this by writing a malicious QCOW2 header to a root or ephemeral disk and triggering a resize, causing qemu-img to overwrite arbitrary files on the compute host with Nova's write permissions. This results in potential data destruction or denial of service on the host system. The issue is classified under CWE-669 (Incorrect Resource Transfer Between Spheres) and CWE-73 (External Control of File Name or Path). Red Hat has rated this vulnerability as Important and has released security advisories and updates for Red Hat OpenStack Services on OpenShift 18.0.18, but a general mitigation or fix for all affected versions is not yet available or does not meet Red Hat's criteria for deployment.
Potential Impact
An authenticated attacker can exploit this vulnerability to overwrite arbitrary files on the compute host, potentially causing data destruction or denial of service. The integrity and availability of the host system are impacted, but confidentiality is not affected. The vulnerability requires local access with low privileges and no user interaction. The CVSS v3.1 base score is 8.2 (high severity) with high impact on integrity and availability.
Mitigation Recommendations
Currently, no official fix or mitigation fully meeting Red Hat's criteria is available. Red Hat has released updated packages for Red Hat OpenStack Services on OpenShift 18.0.18 that address this issue. Users should apply these updates if applicable. For other affected OpenStack Nova versions, monitor vendor advisories for patches or mitigations. Avoid using the Flat image backend with use_cow_images=False if possible, or restrict access to authenticated users to reduce risk. Customers with Red Hat Technical Account Managers can seek direct guidance. Patch status is not yet confirmed for all affected versions; check vendor advisories for current remediation guidance.
CVE-2026-24708: CWE-669 Incorrect Resource Transfer Between Spheres in OpenStack Nova
Description
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
CVSS v3.1
Score 8.2high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenStack Nova versions before 30.2.2, 31.2.1, and 32.1.1 contain a vulnerability (CVE-2026-24708) where the Flat image backend, typically configured with use_cow_images=False, calls the qemu-img utility without format restrictions during image resize operations. An authenticated user can exploit this by writing a malicious QCOW2 header to a root or ephemeral disk and triggering a resize, causing qemu-img to overwrite arbitrary files on the compute host with Nova's write permissions. This results in potential data destruction or denial of service on the host system. The issue is classified under CWE-669 (Incorrect Resource Transfer Between Spheres) and CWE-73 (External Control of File Name or Path). Red Hat has rated this vulnerability as Important and has released security advisories and updates for Red Hat OpenStack Services on OpenShift 18.0.18, but a general mitigation or fix for all affected versions is not yet available or does not meet Red Hat's criteria for deployment.
Potential Impact
An authenticated attacker can exploit this vulnerability to overwrite arbitrary files on the compute host, potentially causing data destruction or denial of service. The integrity and availability of the host system are impacted, but confidentiality is not affected. The vulnerability requires local access with low privileges and no user interaction. The CVSS v3.1 base score is 8.2 (high severity) with high impact on integrity and availability.
Mitigation Recommendations
Currently, no official fix or mitigation fully meeting Red Hat's criteria is available. Red Hat has released updated packages for Red Hat OpenStack Services on OpenShift 18.0.18 that address this issue. Users should apply these updates if applicable. For other affected OpenStack Nova versions, monitor vendor advisories for patches or mitigations. Avoid using the Flat image backend with use_cow_images=False if possible, or restrict access to authenticated users to reduce risk. Customers with Red Hat Technical Account Managers can seek direct guidance. Patch status is not yet confirmed for all affected versions; check vendor advisories for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-01-24T00:00:00.000Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-24708","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:7884","vendor":"Red Hat"}]
Threat ID: 6996fb4b8fb9188dea8c0ded
Added to database: 02/19/2026, 12:00:11 UTC
Last enriched: 08/14/2026, 13:06:19 UTC
Last updated: 09/10/2026, 19:36:53 UTC
Views: 156
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.