PkgSeer

Vulnerability PYSEC-2026-1708

Medium Risk

4 months ago

OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

15.1.5 - 29.0.2

Summary

OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

Details

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints

18.0.2 - 31.3.0 and 32.0.0 - 32.2.0 and 33.0.0 - 33.0.1 PYSEC-2026-2686

OpenStack Nova calls qemu-img without format restrictions for resize

15.1.5 - 30.2.1 and 31.0.0.0rc1 - 31.2.0 and 32.0.0.0rc1 - 32.1.0 PYSEC-2026-2685

OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

15.1.5 - 27.4.0 and 28.0.0 - 28.2.0 and 29.0.0 - 29.1.0 PYSEC-2026-1709

OpenStack Cinder, glance, and Nova vulnerable to Path Traversal

15.1.5 - 24.1.1 and 25.0.0 - 25.0.1 PYSEC-2026-868

OpenStack Nova Changing vnic_type breaks compute service restart

15.1.5 - 23.2.1 and 24.0.0 - 24.1.1 and 25.0.0 - 25.0.1 PYSEC-2026-882

View all vulnerabilities for these packages

Impacted packages

nova

Timeline

Published

4 months ago

Last Modified

4 months ago