CVE-2026-24708

No known exploitation. EPSS puts it in the 29th percentile. No fix published yet.

CVSS 3.18.2High EPSS percentile29th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-02-18Updated 2026-09-11Sources: CVE.org, NVD, GitHub

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check which OpenStack Nova version you run (look for the Nova release/build in your OpenStack deployment).
Verify whether your compute nodes use the Flat image backend (commonly indicated by use_cow_images=False or equivalent Flat backend configuration).
Upgrade OpenStack Nova to a fixed version: 30.2.2, 31.2.1, or 32.1.1 (whichever matches your branch).
After upgrading, retest your normal resize workflow in a non-production environment to confirm resize operations behave as expected.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.

In plain language

Written by AI from the record

OpenStack Nova has a high-impact issue in versions before 30.2.2, 31.2.1, and 32.1.1 where a carefully crafted disk image header and a resize operation can lead to data loss on the compute host; most small businesses only need to worry if you run OpenStack Nova and your setup uses the Flat image backend.

CVE-2026-24708 is an OpenStack Nova vulnerability in the Flat image backend where an attacker can supply a malicious QCOW header on a root or ephemeral disk and then trigger a resize, causing Nova to invoke qemu-img without the expected format restriction and perform an unsafe image resize operation that can destroy host data (affected compute nodes commonly run with use_cow_images=False).

If you're affected

Host data destruction
Compute service disruption
Ransomware-like impact
Loss of tenant workloads

What is it

Think of Nova as the system that manages virtual machine disks. In affected setups, if someone can provide a “fake” disk image header and then make Nova resize the disk, Nova may run the disk conversion tool in a way that performs an unsafe operation, potentially wiping or damaging the host’s data related to that disk.

Who is affected

This matters if you run OpenStack Nova as part of your infrastructure, especially on compute nodes that use the Flat image backend (commonly configured with use_cow_images=False). The issue is tied to resizing root or ephemeral disks using that backend, not all OpenStack Nova usage.

It’s a risk only when the vulnerable image-backend path is reachable in your environment—typically on compute nodes that actually use the Flat image backend and where an attacker can influence the disk image used for a resize operation.

How urgent is it

This is AMBER because the flaw can cause destructive unsafe image resize behavior on the host side, which is the kind of issue that can lead to serious downtime and data loss. However, there is no KEV listing and no public exploit code on record, so it’s not known to be broadly exploited right now.

Focus on patching promptly if your OpenStack Nova compute nodes use the Flat image backend, and prioritize upgrades based on your branch (30/31/32).

What to do — in detail

Confirm exposure in your environment
- Identify your running OpenStack Nova version and branch.
- Determine whether your affected compute nodes use the Flat image backend. The vulnerability description notes that compute nodes using the Flat image backend (usually configured with use_cow_images=False) are the ones at risk.
- Look for whether you perform disk resize operations (especially involving root or ephemeral disks) as part of normal operations or tenant workflows.
Map to fixed versions and plan the upgrade
- If you are on the 30.x branch, upgrade to at least 30.2.2.
- If you are on the 31.x branch, upgrade to at least 31.2.1.
- If you are on the 32.x branch, upgrade to at least 32.1.1.
Upgrade and validation
- Upgrade Nova to the fixed version for your branch.
- Validate in a non-production test environment that your resize workflows still function as expected.
- During/after upgrade, watch for resize-related errors and any unexpected image conversion behavior.
If you can’t patch immediately
- Reduce exposure by limiting which users/tenants can trigger disk resize operations and by ensuring only trusted image sources are used for root/ephemeral disks.
- Confirm whether any part of your process allows user-controlled disk image headers to reach the Flat image backend resize path.
- Use your operational monitoring to detect unusual or repeated resize attempts that could indicate probing.
What to monitor
- Resize operations failing in unusual ways.
- Any errors in image conversion/resize related components.
- Unusual resize activity patterns, especially involving root or ephemeral disks.

Technical context

Severity/score context: reported as HIGH (CVSS 8.2) with impact that includes integrity and availability loss (data destruction risk). Weaknesses are listed as CWE-669 (Reachable Path) and CWE-73 (External Control of File Name or Path) in the record.

Mechanism: By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user can influence Nova’s Flat image backend to call qemu-img without a format restriction, leading to an unsafe image resize operation. This can destroy data on the host system.

Reachability: described as affecting compute nodes using the Flat image backend (usually with use_cow_images=False). No KEV entry exists for this CVE, and there is no public exploit code on record.

Exploitation maturity: not confirmed as exploited in the provided findings (no KEV/news claim) and no exploit code is known publicly. EPSS is provided as a prediction of 0.3% with flat trend, but this should not be treated as evidence of real-world exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS29th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 29th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 205 days, from the signal feeds we watch.

2026-09-11Record updated
2026-08-14Record updated
2026-07-15Record updated
2026-06-30Record updated
2026-06-25OpenVAS check added
2026-02-18Publishedweakness classified

Affected products

OpenStackoss-project · USaka openstack foundation
- NovaOn-premCloud & SaaS / cloud-platform
PyPIpackage-ecosystem
- NovaOSS Libraries

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

Scored 8.2 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

Sources

References in the record

And 9 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Nova, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account