CVE-2026-24708: openstack nova
Vulnerability summary
CVE-2026-24708 is a high (CVSS 8.2) vulnerability in openstack nova. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.9% of scored vulnerabilities.
Not severe (CVSS 8.2, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 18-02-2026PublishedVulnerability first disclosed.
- 11-09-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · PypiEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
- NVDNIST8.2HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 0.38% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-669Incorrect Resource Transfer Between SpheresThe product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat11 products
- openstack-nova< 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
- openstack-nova-api< 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
- openstack-nova-common< 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
- openstack-nova-compute< 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
- openstack-nova-conductor< 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
Debian1 product
- nova< 2:32.1.0-7 | < 2:26.2.2-1~deb12u4 | < 2:31.0.0-6+deb13u2 | < 2:22.4.0-1~deb11u7
Openstack1 product
- nova< 30.2.2 | ≥ 31.0.0, < 31.2.1 | ≥ 32.0.0, < 32.1.1
PyPI1 product
- nova≥ 31.0.0.0rc1, ≤ 31.2.0 | ≤ 30.2.1 | ≥ 32.0.0.0rc1, ≤ 32.1.0
Ubuntu1 product
- novaAll versions (No fix recorded) | < 3:25.2.1-0ubuntu2.10 | < 3:29.2.0-0ubuntu1.3 | < 3:32.0.0-0ubuntu1.1
5 vendors · 15 products
References
21 links
Show all 21 references
- github.com/openstack/novaPACKAGE
- pypi.org/project/novaPACKAGE
