CVE-2026-24708

Name of the Vulnerable Software and Affected Versions OpenStack Nova versions prior to 30.2.2 OpenStack Nova versions prior to 31.2.1 OpenStack Nova versions prior to 32.1.1

Description A flaw in the interaction between OpenStack Nova and the qemu-img utility allows an authenticated user to overwrite arbitrary files or destroy data on the compute host. The issue occurs when Nova's Flat image backend invokes qemu-img without strictly constraining the disk image format. An attacker can exploit this by writing a malicious QCOW header to a root or ephemeral disk and triggering a resize operation. This vulnerability specifically affects compute nodes using the Flat image backend, typically those configured with use cow images set to False.

Recommendations Update OpenStack Nova to version 30.2.2 or later. Update OpenStack Nova to version 31.2.1 or later. Update OpenStack Nova to version 32.1.1 or later. As a temporary mitigation, avoid using the Flat image backend by ensuring use cow images is not set to False.