Read the docs
TI-2026-19922 Aliases CVE-2026-24708GHSA-m4f3-qp2w-gwh6

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before…

Priority LOW 36CWE-669Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 4 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00416 36th percentileScored 2026-11-07
Fix Partial Nova (OpenStack): 30.2.2, 31.2.1, 32.1.1Red Hat: 4 advisoriesRed Hat: 4 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenStackNovabefore 30.2.2; 31.0.0 to before 31.2.1; 32.0.0 to before 32.1.130.2.2, 31.2.1, 32.1.1Patch availableCNA
—Nova (PyPI)32.0.0.0rc1 – 32.1.0—No fix listedGHSA-m4f3-qp2w-gwh6
—Nova (PyPI)31.0.0.0rc1 – 31.2.0—No fix listedGHSA-m4f3-qp2w-gwh6
—Nova (PyPI)up to 30.2.1—No fix listedGHSA-m4f3-qp2w-gwh6
  • Nova VendorOpenStack Affected before 30.2.2; 31.0.0 to before 31.2.1; 32.0.0 to before 32.1.1 Fixed in 30.2.2, 31.2.1, 32.1.1 Patch available CNA
  • Nova (PyPI) Vendor— Affected 32.0.0.0rc1 – 32.1.0 Fixed in — No fix listed GHSA-m4f3-qp2w-gwh6
  • Nova (PyPI) Vendor— Affected 31.0.0.0rc1 – 31.2.0 Fixed in — No fix listed GHSA-m4f3-qp2w-gwh6
  • Nova (PyPI) Vendor— Affected up to 30.2.1 Fixed in — No fix listed GHSA-m4f3-qp2w-gwh6

Remediation

  • Fix · CNA Nova (OpenStack) Fixed in 30.2.2, 31.2.1, 32.1.1

Red Hat 4 advisories

  • RHSA-2026:94039 Released 2026-11-02 · Red Hat rating Important
    Red Hat OpenStack Platform 13.0 security advisory
    • Red Hat OpenStack Platform 13.0 - ELS openstack-keystone-1:13.0.4-10.el7ost, openstack-nova-1:17.0.13-43.el7ost, openstack-nova-api-1:17.0.13-43.el7ost +16
  • RHSA-2026:66401 Released 2026-09-10 · Red Hat rating Important
    Red Hat OpenStack Platform 17.1 security and bug fix advisory
    • Red Hat OpenStack Platform 17.1 ansible-collection-ansible-posix-1.2.0-1.4.el9ost, ansible-collections-openstack-1.9.1-17.1.20260318160829.0e9a6f2.el9ost, collectd-sensubility-0.2.1-6.el9ost +47
  • RHSA-2026:54757 Released 2026-08-13 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2 security advisory
    • Red Hat OpenStack Platform 16.2 collectd-sensubility-0.2.1-1.1.el8ost, erlang-23.3.4.18-2.el8ost, erlang-asn1-23.3.4.18-2.el8ost +41
Show 1 more Red Hat advisories
  • RHSA-2026:7884 Released 2026-04-29 · Red Hat rating Important
    Red Hat OpenStack Services on OpenShift 18.0.18 (openstack-nova) security update
    • Red Hat OpenStack Services on OpenShift 18.0 openstack-nova-1:27.5.2-18.0.20260312122217.c1c6d67.el9ost, openstack-nova-api-1:27.5.2-18.0.20260312122217.c1c6d67.el9ost, openstack-nova-common-1:27.5.2-18.0.20260312122217.c1c6d67.el9ost +8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat OpenStack Platform 17.1AffectedNo fix yet
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat OpenStack Platform 13.0 - ELSFixed RHSA-2026:94039
Red Hat OpenStack Platform 16.2Fixed RHSA-2026:54757
Red Hat OpenStack Platform 17.1Fixed RHSA-2026:66401
Red Hat OpenStack Services on OpenShift 18.0Fixed RHSA-2026:7884
Not affected: 4 products
  • Red Hat OpenStack Platform 13.0 - ELS
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24708
  2. 2026-10-03 Alias added: GHSA-m4f3-qp2w-gwh6
  3. 2026-11-03 Fix available: RHSA-2026:94039 · Red Hat
  4. 2026-11-03 Fix available: Red Hat OpenStack Platform 13.0 - ELS · Red Hat

References

Advisory 1

Other 5

  • TI-2026-78562 Incorrect authorization in OpenStack Manila share operations CVSS 3.1CRITICAL 9.9
  • TI-2026-63467 Code injection in OpenStack Octavia CVSS 4.0CRITICAL 9.4
  • TI-2017-13226 The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before… CVSS 3.1CRITICAL 9.8
  • TI-2026-69629 OpenStack Mistral flaw lets users change other projects' resources CVSS 4.0HIGH 7.2
  • TI-2026-69623 Command injection in OpenStack Mistral std.ssh_proxied action CVSS 4.0HIGH 8.7
  • TI-2022-17779 Improper privilege management in OpenStack CVSS 3.1HIGH 8.8
See all 332 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences