CVE-2026-24708: 
OpenStack Nova vulnerability analysis and mitigation

CVE-2026-24708 is a vulnerability in OpenStack Nova titled "Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling" (OSSA-2026-002). It allows an authenticated attacker to overwrite arbitrary files on the compute host by crafting a malicious QCOW2 header on a raw disk and triggering an instance resize operation. The flaw was reported by Dan Smith from Red Hat, disclosed on January 17, 2026, and published on February 17–18, 2026. Affected Nova versions are <30.2.2, >=31.0.0 <31.2.1, and >=32.0.0 <32.1.1; only compute nodes using the Flat image backend (typically use_cow_images=False) are affected (Red Hat Advisory, oss-security). The CVSS v3.1 base score is 8.2 (High), with a Changed scope, High integrity and availability impacts, and no confidentiality impact (Red Hat Advisory).

The root cause is classified under CWE-73 (External Control of File Name or Path) and CWE-669 (Incorrect Resource Transfer Between Spheres). Nova's flat image backend invokes qemu-img during instance resize operations without strictly enforcing the expected disk image format. An authenticated user can write a crafted QCOW2 header to a raw ephemeral or root disk; when Nova subsequently calls qemu-img for a resize, the utility interprets the disk as QCOW2 and follows backing file references or writes to paths that Nova has write access to on the host, enabling arbitrary file overwrite. Exploitation requires only low-privilege authenticated access to Nova and no user interaction, but does require high attack complexity (oss-security, Red Hat Bugzilla). Patches are available at OpenDev review links for the 2024.2/dalmatian, 2025.1/epoxy, 2025.2/flamingo, and 2026.1/gazpacho branches (oss-security).

Successful exploitation allows an authenticated attacker to overwrite arbitrary files on the compute host that the Nova service account has write access to, resulting in high integrity and high availability impacts with a Changed scope (affecting resources beyond the vulnerable component). Attackers can destroy other tenants' data, corrupt Nova-managed files, or cause denial of service on the compute node, potentially disrupting all virtual machine instances hosted on that node (Red Hat Bugzilla, Red Hat Advisory). There is no direct confidentiality impact, but the ability to corrupt host-level files could facilitate further lateral movement within the OpenStack infrastructure.

1. Reconnaissance: Identify an OpenStack Nova deployment using the Flat image backend (use_cow_images=False) and obtain low-privilege authenticated access to the Nova API.
2. Craft malicious disk image: Create a raw disk image and write a crafted QCOW2 header at the beginning of the file, optionally including a backing file path pointing to a sensitive host file (e.g., /etc/passwd or a Nova configuration file).
3. Upload malicious image: Upload the crafted disk image to the OpenStack image service (Glance) or attach it as an ephemeral/root disk to a Nova instance under the attacker's control.
4. Trigger resize operation: Initiate an instance resize operation via the Nova API (nova resize), which causes Nova's flat image backend to invoke qemu-img on the disk without format restrictions.
5. Achieve arbitrary file overwrite: qemu-img interprets the disk as QCOW2 and processes the crafted header, resulting in overwrite of arbitrary files on the compute host that the Nova service account can write to, potentially corrupting system files or causing denial of service (oss-security, Red Hat Bugzilla).

• Logs: Nova compute logs (nova-compute.log) showing qemu-img invocations during resize operations on instances with unexpected disk format detection (QCOW2 detected on a disk expected to be raw); errors related to backing file resolution pointing to unusual host paths.
• File System: Unexpected modification timestamps on host system files (e.g., /etc/, Nova configuration directories, or other files writable by the Nova service account); newly corrupted or zero-length files in Nova-managed directories.
• Process: qemu-img child processes spawned by the Nova compute service with arguments referencing unexpected file paths or backing files outside normal image storage directories.
• Network: Unusual Nova API calls from authenticated users triggering repeated resize operations on the same instance, particularly from accounts with no prior resize history (Red Hat Bugzilla, oss-security).

Red Hat released a fix via RHSA-2026:7884 for Red Hat OpenStack Services on OpenShift 18.0, published April 29, 2026 (Red Hat Bugzilla). Upstream Nova patches are available for all affected branches: 2024.2/dalmatian (review 977104), 2025.1/epoxy (977103), 2025.2/flamingo (977101), and 2026.1/gazpacho (977100), targeting fixed versions 30.2.2, 31.2.1, and 32.1.1 (oss-security). As a workaround, operators can set use_cow_images=True in Nova's configuration to avoid using the Flat image backend, which is the only affected backend. Debian also issued security advisories (DSA-6145-1 and DLA-4486-1) with updated Nova packages for affected distributions.

The OpenStack Vulnerability Management Team (Jeremy Stanley) published the official advisory OSSA-2026-002 on February 17, 2026, via the oss-security mailing list, including an errata correcting a CVE identifier mix-up with CVE-2026-24709 (oss-security). The vulnerability received coverage from security aggregators including LinuxSecurity.com (covering both the Debian DSA and DLA advisories), cyberhub.blog, and The Hacker Wire. Social media activity on Bluesky noted the disclosure, and TUXEDO Computers referenced it in their weekly OS update summary. Community reaction was moderate, consistent with a medium-severity cloud infrastructure vulnerability requiring authenticated access.