CVE-2026-24708 OpenStack Nova calls qemu-img without format restrictions for resize
A malicious QCOW header can cause unsafe image resizing in OpenStack Nova's Flat backend, potentially destroying host data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24708?
CVE-2026-24708 is a high-severity vulnerability in OpenStack Nova, published on 18 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
Which versions are affected by CVE-2026-24708?
7 open source packages ship an affected version, including nova and Nova.
| Package | Affected | Fixed in |
|---|---|---|
nova PyPI | All versions to 30.2.1 | None |
nova PyPI | All versions to 30.2.1 | None |
nova PyPI | From 31.0.0.0rc1 to 31.2.0 | None |
nova PyPI | From 32.0.0.0rc1 to 32.1.0 | None |
Nova PyPI | All versions to 30.2.1 | None |
Nova PyPI | From 31.0.0.0rc1 to 31.2.0 | None |
1 more packages
Nova PyPI | From 32.0.0.0rc1 to 32.1.0 | None |
Linux distribution packages (11)
openstack-nova Red Hat:openstack:18.0::el9 | All versions | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
openstack-nova-api Red Hat:openstack:18.0::el9 | All versions | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
openstack-nova-common Red Hat:openstack:18.0::el9 | All versions | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
openstack-nova-compute Red Hat:openstack:18.0::el9 | All versions | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
openstack-nova-conductor Red Hat:openstack:18.0::el9 | All versions | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
openstack-nova-migration Red Hat:openstack:18.0::el9 | All versions | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
openstack-nova-novncproxy Red Hat:openstack:18.0::el9 | All versions | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
openstack-nova-scheduler Red Hat:openstack:18.0::el9 | All versions | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
openstack-nova-serialproxy Red Hat:openstack:18.0::el9 | All versions | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
openstack-nova-spicehtml5proxy Red Hat:openstack:18.0::el9 | All versions | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
python3-nova Red Hat:openstack:18.0::el9 | All versions | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
How do I fix CVE-2026-24708?
Upgrade to a fixed version.
Is CVE-2026-24708 being exploited?
There is no known exploitation of CVE-2026-24708 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-24708, DLA-4486-1, DSA-6145-1, GHSA-m4f3-qp2w-gwh6, PYSEC-2026-2685, RHSA-2026:7884 and 1 more.