OpenStack components Cinder (up to 24.0.0), Glance (before 28.0.2), and Nova (before 29.0.3) contain a vulnerability allowing authenticated users to access arbitrary files on the server via crafted QCOW2 images. This issue affects all Cinder and Nova deployments, and Glance deployments only if image conversion is enabled. The vulnerability can lead to unauthorized disclosure of sensitive data.