Skip to content
OpenAdvisories
High · 8.2 CVE-2026-24708 EUVD-2026-7738GHSA-m4f3-qp2w-gwh6PYSEC-2026-2685

OpenStack Nova calls qemu-img without format restrictions for resize

Published Feb 18, 2026 · Updated Sep 11, 2026 · Assigned by mitre

Vendor: OpenStack Product: Nova Package: nova Package: nova Package: nova Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu

Description

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.

Affected products

VendorProductAffectedFixed
OpenStack Nova < 30.2.2, 31.0.0 – < 31.2.1, 32.0.0 – < 32.1.1 30.2.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 nova 2:32.1.0-7 —
Debian 13 nova 2:31.0.0-6+deb13u2 DSA-6145-1
Debian 12 nova 2:26.2.2-1~deb12u4 DSA-6145-1
Debian 11 nova 2:22.4.0-1~deb11u7 DLA-4486-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 nova 3:32.0.0-0ubuntu1.1 —
Ubuntu 24.04 LTS nova 3:29.2.0-0ubuntu1.3 —
Ubuntu 22.04 LTS nova 3:25.2.1-0ubuntu2.10 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS nova No fix yet —
Ubuntu Pro 18.04 LTS nova No fix yet —
Ubuntu Pro 16.04 LTS nova No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenStack 18 python3-nova +10 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost RHSA-2026:7884
Red Hat OpenStack 17 ansible-collection-ansible-posix 1.2.0-1.4.el9ost RHSA-2026:66401
Red Hat OpenStack 17 ansible-collections-openstack 1.9.1-17.1.20260318160829.0e9a6f2.el9ost RHSA-2026:66401
Red Hat OpenStack 17 collectd-sensubility 0.2.1-6.el9ost RHSA-2026:66401
Red Hat OpenStack 17 erlang +19 24.3.4.2-7.el9ost RHSA-2026:66401
Red Hat OpenStack 17 etcd 3.4.26-9.6.el9ost RHSA-2026:66401
Red Hat OpenStack 17 openstack-dashboard +2 1:19.4.1-17.1.20260630130603.9b1a13e.el9ost RHSA-2026:66401
Red Hat OpenStack 17 openstack-heat +5 1:16.1.1-17.1.20260713101101.edc6d60.el9ost RHSA-2026:66401
Red Hat OpenStack 17 openstack-ironic +3 1:17.1.1-17.1.20260721220909.c31db88.el9ost RHSA-2026:66401
Red Hat OpenStack 17 openstack-selinux 0.8.37-17.1.20260107141051.05dd1b2.el9ost RHSA-2026:66401
Red Hat OpenStack 17 openstack-tripleo-heat-templates 14.3.1-17.1.20260803105013.e7c7ce3.el9ost RHSA-2026:66401
Red Hat OpenStack 17 os-net-config 14.2.1-17.1.20260803103231.61d7bd7.el9ost RHSA-2026:66401
Red Hat OpenStack 17 puppet-rabbitmq 11.0.1-17.1.20260306080955.63fee2c.el9ost RHSA-2026:66401
Red Hat OpenStack 17 puppet-tripleo 14.2.3-17.1.20260206090839.40278e1.el9ost RHSA-2026:66401
Red Hat OpenStack 17 python-cinder-tests-tempest +1 1.8.0-17.1.20260114160833.0e94611.el9ost RHSA-2026:66401
Red Hat OpenStack 17 python-glance-store +1 2.5.1-17.1.20260225150839.5f1cee6.el9ost RHSA-2026:66401
Red Hat OpenStack 17 python-os-brick +1 4.3.4-17.1.20260324150947.cf69f92.el9ost RHSA-2026:66401
Red Hat OpenStack 17 python-oslo-messaging +1 12.7.3-17.1.20260701150916.5d6fd1a.el9ost RHSA-2026:66401
Red Hat OpenStack 17 python-oslo-serialization +1 4.1.1-17.1.20260326121047.bbe5d5a.el9ost RHSA-2026:66401
Red Hat OpenStack 17 python-ovsdbapp +1 1.9.4-17.1.20260304101059.65d02f0.el9ost RHSA-2026:66401
Red Hat OpenStack 17 python3-cinder +2 1:18.2.2-17.1.20260702111621.f6b44fc.el9ost RHSA-2026:66401
Red Hat OpenStack 17 python3-ironic-python-agent +1 7.1.1-17.1.20260803104219.0211fa9.el9ost RHSA-2026:66401
Red Hat OpenStack 17 python3-keystone +1 1:19.0.2-17.1.20260630150819.54dd95d.el9ost RHSA-2026:66401
Red Hat OpenStack 17 python3-neutron +11 1:18.6.1-17.1.20260810120959.85ff760.el9ost RHSA-2026:66401
Red Hat OpenStack 17 python3-nova +10 1:23.2.3-17.1.20260810140853.2ace99d.el9ost RHSA-2026:66401
Red Hat OpenStack 17 python3-swift +5 2.27.1-17.1.20260806131309.16dbcae.el9ost RHSA-2026:66401
Red Hat OpenStack 17 rhosp-director-images +14 17.1-20260901.1.el9ost RHSA-2026:66401
Red Hat OpenStack 17 tripleo-ansible 3.3.1-17.1.20260603190918.8debef3.el9ost RHSA-2026:66401
Red Hat OpenStack 16 collectd-sensubility 0.2.1-1.1.el8ost RHSA-2026:54757
Red Hat OpenStack 16 erlang +20 23.3.4.18-2.el8ost RHSA-2026:54757
Red Hat OpenStack 16 etcd 3.3.23-22.el8ost RHSA-2026:54757
Red Hat OpenStack 16 python-oslo-messaging +1 10.2.4-2.20260710155333.82281a0.el8ost RHSA-2026:54757
Red Hat OpenStack 16 python-pyasn1 +2 0.4.6-4.el8ost RHSA-2026:54757
Red Hat OpenStack 16 python3-glance +1 1:19.0.5-2.20260512165254.eb6ad61.el8ost RHSA-2026:54757
Red Hat OpenStack 16 python3-keystone +1 1:16.0.3-2.20260616134936.9d699a7.el8ost RHSA-2026:54757
Red Hat OpenStack 16 python3-nova +11 1:20.6.2-2.20260317135026.8a24acd.el8ost RHSA-2026:54757

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI nova >= 32.0.0.0rc1, <= 32.1.0 — GHSA-m4f3-qp2w-gwh6
PyPI nova >= 31.0.0.0rc1, <= 31.2.0 — GHSA-m4f3-qp2w-gwh6
PyPI nova <= 30.2.1 — GHSA-m4f3-qp2w-gwh6
PyPI nova <= 30.2.1 · >= 31.0.0.0rc1, <= 31.2.0 · >= 32.0.0.0rc1, <= 32.1.0 — PYSEC-2026-2685

Advisories 6

References