CVE-2026-63623: libvirt Information Disclosure Vulnerability

CVE-2026-63623 Overview

A flaw in libvirt exposes guest virtual machine disk contents to unauthorized local users. During storage volume clone or convert operations, the qemu-img utility creates new volume images with overly permissive file permissions. The resulting images are temporarily world-readable on the host system. Any local user with shell access can read the full contents of guest disks during this window. The issue is tracked as an incorrect permission assignment for a critical resource [CWE-732].

Critical Impact
Local users on the libvirt host can read complete guest virtual machine disk contents, resulting in disclosure of credentials, encryption keys, and other sensitive data stored inside guest VMs.

Affected Products

libvirt (versions affected by the qemu-img clone and convert code path)
Red Hat distributions shipping the vulnerable libvirt package
Host systems performing storage volume clone or convert operations

Discovery Timeline

2026-08-10 - CVE-2026-63623 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-63623

Vulnerability Analysis

The vulnerability affects libvirt storage volume management operations. When libvirt invokes qemu-img to clone or convert a storage volume, the destination image file is created with permissive file mode bits. Any local user on the host can open the file for reading during the operation. Because guest disk images typically contain the entire filesystem of a virtual machine, the exposure covers user credentials, SSH keys, application secrets, and any other data stored in the guest.

The defect maps to [CWE-732: Incorrect Permission Assignment for Critical Resource]. The exposure is confidentiality-focused. The vulnerability does not permit modification of the target file or disruption of the host, and it requires an existing local account on the libvirt host.

Root Cause

The root cause is that qemu-img, when spawned by libvirt during clone or convert workflows, uses default file creation settings that do not restrict access to the volume owner. Libvirt does not apply a restrictive umask or explicit chmod before or during image materialization. New volume images therefore inherit world-readable permissions until libvirt finalizes ownership on the completed image.

Attack Vector

An attacker must have a local unprivileged account on the host running libvirt. The attacker monitors the storage pool directory for new image files created during a clone or convert operation. Once a temporary image appears, the attacker opens the file and reads its contents before libvirt tightens permissions. No user interaction or elevated privileges are required to complete the read.

The vulnerability manifests in the interaction between libvirt storage driver logic and the qemu-img process invocation. See the Red Hat CVE-2026-63623 advisory and Red Hat Bug Report #2513066 for technical details.

Detection Methods for CVE-2026-63623

Indicators of Compromise

Unexpected read access from non-root, non-qemu users to files inside libvirt storage pool directories such as /var/lib/libvirt/images/.
Presence of newly created disk image files with mode bits granting read access to other (for example, -rw-r--r--) during clone or convert operations.
Audit records showing open() or read() syscalls on volume image paths by unprivileged user identifiers.

Detection Strategies

Enable Linux audit rules on libvirt storage pool paths to log file access by users other than root and qemu.
Monitor virsh vol-clone and virsh vol-convert command execution and correlate with concurrent file access events from unrelated user sessions.
Compare file permission state of newly created images against expected owner-only access policies.

Monitoring Recommendations

Alert on any process not owned by libvirtd or qemu opening files in configured storage pool directories.
Track process ancestry for qemu-img convert and qemu-img create invocations and inspect the resulting file mode.
Review host user account inventory and remove or restrict interactive local accounts on virtualization hosts.

How to Mitigate CVE-2026-63623

Immediate Actions Required

Apply the libvirt security update from your distribution vendor as soon as it becomes available.
Restrict interactive local access on virtualization hosts to administrators only.
Postpone non-essential storage volume clone and convert operations on shared or multi-tenant hosts until patches are installed.
Verify permissions on existing volume images and set them to owner-only read where appropriate.

Patch Information

Red Hat is tracking the fix through Red Hat CVE-2026-63623 and Red Hat Bug Report #2513066. Consult the vendor advisory for the specific libvirt package version that includes the corrected qemu-img invocation logic. Apply the update using the standard package manager for your distribution.

Workarounds

Set a restrictive umask (for example, 0077) for the libvirtd service environment so that new files are created without world-readable bits.
Restrict access to libvirt storage pool directories using chmod 0700 on the pool root and confirm SELinux or AppArmor policies limit access to authorized processes.
Perform clone and convert operations on isolated management hosts that do not host untrusted local users.
Store guest disk images on filesystems with additional access controls, such as encrypted volumes tied to specific service accounts.

bash

# Configuration example: restrict libvirt storage pool access
sudo chmod 0700 /var/lib/libvirt/images
sudo chown root:root /var/lib/libvirt/images

# Enforce restrictive umask for the libvirtd service
sudo mkdir -p /etc/systemd/system/libvirtd.service.d
sudo tee /etc/systemd/system/libvirtd.service.d/umask.conf <<EOF
[Service]
UMask=0077
EOF
sudo systemctl daemon-reload
sudo systemctl restart libvirtd