CVE-2026-24708: OpenStack Nova Privilege Escalation Flaw

CVE-2026-24708 Overview

A critical vulnerability has been discovered in OpenStack Nova affecting versions before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. This flaw allows authenticated users to write a malicious QCOW header to a root or ephemeral disk and then trigger a resize operation. By exploiting this vulnerability, an attacker can convince Nova's Flat image backend to call qemu-img without proper format restrictions, resulting in an unsafe image resize operation that could destroy data on the host system.

This vulnerability is classified as CWE-669 (Incorrect Resource Transfer Between Spheres), indicating improper handling of resources across security boundaries. The attack requires network access and low privileges but involves high attack complexity.

Critical Impact

Successful exploitation could lead to destruction of data on host systems running OpenStack Nova compute nodes with the Flat image backend, potentially compromising the integrity and availability of cloud infrastructure.

Affected Products

• OpenStack Nova versions before 30.2.2
• OpenStack Nova versions 31 before 31.2.1
• OpenStack Nova versions 32 before 32.1.1

Discovery Timeline

• 2026-02-18 - CVE-2026-24708 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-24708

Vulnerability Analysis

The vulnerability exists in how OpenStack Nova's Flat image backend processes disk resize operations. When a compute node is configured with use_cow_images=False, Nova uses the Flat image backend to manage virtual machine disks. Under normal circumstances, qemu-img operations should enforce strict format validation to prevent malicious image headers from being interpreted during processing.

The flaw occurs because the Flat image backend fails to specify a format restriction when invoking qemu-img for resize operations. This allows an attacker who can write to a root or ephemeral disk to craft a malicious QCOW header. When a resize operation is subsequently triggered, qemu-img may interpret this malicious header, leading to unintended operations that can destroy data on the host system.

The attack requires the attacker to have authenticated access to the OpenStack environment with the ability to write to disk images and trigger resize operations. While the attack complexity is high due to the need for specific backend configurations, the potential impact on integrity and availability is severe.

Root Cause

The root cause is the failure to enforce format restrictions when Nova's Flat image backend calls qemu-img during resize operations. Without explicit format specification, qemu-img may auto-detect and process image formats based on headers embedded in the disk data, allowing an attacker-controlled QCOW header to influence the resize behavior.

This represents a case of incorrect resource transfer between security spheres (CWE-669), where user-controlled disk content can influence privileged operations on the host system.

Attack Vector

The attack leverages network access to the OpenStack environment. An authenticated attacker with low privileges can:

1. Write a crafted malicious QCOW header to a root or ephemeral disk attached to their instance
2. Trigger a resize operation on the affected disk
3. Exploit the lack of format restrictions to cause qemu-img to misinterpret the disk contents
4. Potentially cause data destruction on the host system

This attack only affects compute nodes using the Flat image backend, typically configured with use_cow_images=False. Environments using other image backends or default configurations may not be vulnerable.

For detailed technical information about the vulnerability mechanism and attack methodology, refer to the Launchpad Bug Report #2137507 and the OpenWall OSS Security Mailing.

Detection Methods for CVE-2026-24708

Indicators of Compromise

• Unusual disk resize operations on compute nodes with Flat image backend
• Unexpected qemu-img invocations without explicit format parameters in Nova logs
• Anomalous disk activity or data corruption on hypervisor hosts
• Error messages related to QCOW header parsing during resize operations

Detection Strategies

• Monitor Nova compute logs for resize operations on nodes configured with use_cow_images=False
• Implement file integrity monitoring on hypervisor host filesystems to detect unexpected modifications
• Audit qemu-img command invocations to identify calls lacking format specification flags
• Review OpenStack audit logs for unusual patterns of disk resize requests from individual tenants

Monitoring Recommendations

• Enable verbose logging for Nova compute services to capture detailed qemu-img invocations
• Implement alerting for any data corruption events on compute node storage
• Monitor for QCOW header signatures in raw disk images where they should not exist
• Track disk resize operation frequency per tenant to identify potential exploitation attempts

How to Mitigate CVE-2026-24708

Immediate Actions Required

• Identify all compute nodes running with use_cow_images=False configuration
• Upgrade OpenStack Nova to patched versions: 30.2.2, 31.2.1, or 32.1.1
• Review recent disk resize operations for any suspicious activity
• Consider temporarily disabling disk resize functionality on affected nodes until patches are applied

Patch Information

OpenStack has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions:

• Nova 30.x: Upgrade to version 30.2.2 or later
• Nova 31.x: Upgrade to version 31.2.1 or later
• Nova 32.x: Upgrade to version 32.1.1 or later

For additional details on the security patches, consult the Launchpad Bug Report #2137507.

Workarounds

• Enable COW images by setting use_cow_images=True if operationally feasible, as this uses a different image backend
• Restrict disk resize operations through policy controls until patches can be applied
• Implement additional access controls to limit which users can trigger resize operations
• Consider network segmentation to limit access to compute API endpoints

# Check current image backend configuration
grep -r "use_cow_images" /etc/nova/nova.conf

# Temporary workaround: Enable COW images (if feasible)
# Edit /etc/nova/nova.conf and set:
# [DEFAULT]
# use_cow_images = True

# Restart Nova compute service after configuration change
systemctl restart nova-compute