OpenStack Nova 30.2.2/31.2.1/32.1.1: Flat Image Backend Unsafe Resize
CVE-2026-24708 Published on February 18, 2026
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
Weakness Type
Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Products Associated with CVE-2026-24708
Want to know whenever a new CVE is published for OpenStack Nova? stack.watch will email you.
Affected Versions
OpenStack Nova:- Before 30.2.2 is affected.
- Version 31.0.0 and below 31.2.1 is affected.
- Version 32.0.0 and below 32.1.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.