Skip to content
OpenAdvisories
High RHSA-2026:7884 1 CVE

Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0.18 (openstack-nova) security update

Published Apr 29, 2026 · Updated Sep 11, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · OpenStack 18 openstack:18.0::el9 openstack-nova 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 openstack-nova-api 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 openstack-nova-common 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 openstack-nova-compute 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 openstack-nova-conductor 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 openstack-nova-migration 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 openstack-nova-novncproxy 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 openstack-nova-scheduler 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 openstack-nova-serialproxy 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 openstack-nova-spicehtml5proxy 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 python3-nova 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost

Vulnerabilities 1

  • High 8.2
    CVE-2026-24708

    OpenStack Nova calls qemu-img without format restrictions for resize

    An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img withou…

    OpenStack Nova nova nova Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430312
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7884.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-24708
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-24708
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-24708
  • article
    https://bugs.launchpad.net/nova/+bug/2137507