How severe is CVE-2024-40767?

CVE-2024-40767 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2024-40767 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-40767?

CVE-2024-40767 affects Openstack Nova. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-40767?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-40767 have an EU (EUVD) identifier?

Yes. CVE-2024-40767 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-2412.

When was CVE-2024-40767 published?

CVE-2024-40767 was published on 2024-07-24 and last updated on 2026-06-17.

CVE-2024-40767

CVE-2024-40767 is a medium-severity vulnerability in Openstack Nova with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-552.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 1% (57th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-2412
Weakness: CWE-552
Affected product: Openstack Nova
Published: 2024-07-24
Last modified: 2026-06-17

Description

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

Frequently asked questions

What is CVE-2024-40767?: In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.
How severe is CVE-2024-40767?: CVE-2024-40767 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-40767 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-40767?: CVE-2024-40767 affects Openstack Nova. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-40767?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-40767 have an EU (EUVD) identifier?: Yes. CVE-2024-40767 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-2412.
When was CVE-2024-40767 published?: CVE-2024-40767 was published on 2024-07-24 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*

More vulnerabilities in Openstack Nova

CVE-2017-7214 — Critical (CVSS 9.8): An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x…
CVE-2011-3147 — High (CVSS 8.6): Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a…
CVE-2017-17051 — High (CVSS 8.6): An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance…
CVE-2020-17376 — High (CVSS 8.3): An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1,…
CVE-2017-18191 — High (CVSS 7.5): An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an…
CVE-2015-5162 — High (CVSS 7.5): The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before…

All CVEs affecting Openstack Nova →

Other CWE-552 (Files or Directories Accessible to External Parties) vulnerabilities

CVE-2025-41240 — Critical (CVSS 10.0): Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located…
CVE-2024-56731 — Critical (CVSS 10.0): Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the…
CVE-2024-6209 — Critical (CVSS 10.0): Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series…
CVE-2025-14771 — Critical (CVSS 9.9): Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus:…
CVE-2024-39931 — Critical (CVSS 9.9): Gogs through 0.13.0 allows deletion of internal files.
CVE-2021-43821 — Critical (CVSS 9.9): Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6…

Browse all CWE-552 (Files or Directories Accessible to External Parties) vulnerabilities →