CVE-2026-27211

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27211", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-18T19:47:02.156Z", "datePublished": "2026-02-21T05:36:33.169Z", "dateUpdated": "2026-02-25T21:17:44.674Z"}, "containers": {"cna": {"title": "Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse", "problemTypes": [{"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-jmr4-g2hv-mjj6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-jmr4-g2hv-mjj6"}, {"name": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/081a6ebb5184228ff348601502258f3f72bd8b43", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/081a6ebb5184228ff348601502258f3f72bd8b43"}, {"name": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/509832298b6865365b00bda88722e76e41ce7f41", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/509832298b6865365b00bda88722e76e41ce7f41"}, {"name": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/a63315df54e06f6ec867f17b63076c266e2d8648", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/a63315df54e06f6ec867f17b63076c266e2d8648"}, {"name": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/cb495959a8bea1b56e8fc82d15ba527a0e7fcf3c", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/cb495959a8bea1b56e8fc82d15ba527a0e7fcf3c"}, {"name": "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v50.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v50.1"}, {"name": "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v51.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v51.0"}], "affected": [{"vendor": "cloud-hypervisor", "product": "cloud-hypervisor", "versions": [{"version": ">= 34.0, < 50.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T05:36:33.169Z"}, "descriptions": [{"lang": "en", "value": "Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. Versions 34.0 through 50.0 arevulnerable to arbitrary host file exfiltration (constrained by process privileges) when using virtio-block devices backed by raw images. A malicious guest can overwrite its disk header with a crafted QCOW2 structure pointing to a sensitive host path. Upon the next VM boot or disk scan, the image format auto-detection parses this header and serves the host file's contents to the guest. Guest-initiated VM reboots are sufficient to trigger a disk scan and do not cause the Cloud Hypervisor process to exit. Therefore, a single VM can perform this attack without needing interaction from the management stack. Successful exploitation requires the backing image to be either writable by the guest or sourced from an untrusted origin. Deployments utilizing only trusted, read-only images are not affected. This issue has been fixed in version 50.1. To workaround, enable land lock sandboxing and restrict process privileges and access."}], "source": {"advisory": "GHSA-jmr4-g2hv-mjj6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T21:17:31.615787Z", "id": "CVE-2026-27211", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:17:44.674Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27211", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T21:17:31.615787Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:17:40.992Z"}}], "cna": {"title": "Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse", "source": {"advisory": "GHSA-jmr4-g2hv-mjj6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "cloud-hypervisor", "product": "cloud-hypervisor", "versions": [{"status": "affected", "version": ">= 34.0, < 50.1"}]}], "references": [{"url": "https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-jmr4-g2hv-mjj6", "name": "https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-jmr4-g2hv-mjj6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/081a6ebb5184228ff348601502258f3f72bd8b43", "name": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/081a6ebb5184228ff348601502258f3f72bd8b43", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/509832298b6865365b00bda88722e76e41ce7f41", "name": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/509832298b6865365b00bda88722e76e41ce7f41", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/a63315df54e06f6ec867f17b63076c266e2d8648", "name": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/a63315df54e06f6ec867f17b63076c266e2d8648", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/cb495959a8bea1b56e8fc82d15ba527a0e7fcf3c", "name": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/cb495959a8bea1b56e8fc82d15ba527a0e7fcf3c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v50.1", "name": "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v50.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v51.0", "name": "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v51.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. Versions 34.0 through 50.0 arevulnerable to arbitrary host file exfiltration (constrained by process privileges) when using virtio-block devices backed by raw images. A malicious guest can overwrite its disk header with a crafted QCOW2 structure pointing to a sensitive host path. Upon the next VM boot or disk scan, the image format auto-detection parses this header and serves the host file's contents to the guest. Guest-initiated VM reboots are sufficient to trigger a disk scan and do not cause the Cloud Hypervisor process to exit. Therefore, a single VM can perform this attack without needing interaction from the management stack. Successful exploitation requires the backing image to be either writable by the guest or sourced from an untrusted origin. Deployments utilizing only trusted, read-only images are not affected. This issue has been fixed in version 50.1. To workaround, enable land lock sandboxing and restrict process privileges and access."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T05:36:33.169Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27211", "state": "PUBLISHED", "dateUpdated": "2026-02-25T21:17:44.674Z", "dateReserved": "2026-02-18T19:47:02.156Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-21T05:36:33.169Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cloud-hypervisor", "vendor": "cloud-hypervisor", "versions": [{"status": "affected", "version": ">= 34.0, < 50.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cloudhypervisor:cloud_hypervisor:*:*:*:*:*:rust:*:*", "matchCriteriaId": "DE7082B0-CAF7-4360-9514-D81B0372765D", "versionEndExcluding": "50.1", "versionStartIncluding": "34.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. Versions 34.0 through 50.0 arevulnerable to arbitrary host file exfiltration (constrained by process privileges) when using virtio-block devices backed by raw images. A malicious guest can overwrite its disk header with a crafted QCOW2 structure pointing to a sensitive host path. Upon the next VM boot or disk scan, the image format auto-detection parses this header and serves the host file's contents to the guest. Guest-initiated VM reboots are sufficient to trigger a disk scan and do not cause the Cloud Hypervisor process to exit. Therefore, a single VM can perform this attack without needing interaction from the management stack. Successful exploitation requires the backing image to be either writable by the guest or sourced from an untrusted origin. Deployments utilizing only trusted, read-only images are not affected. This issue has been fixed in version 50.1. To workaround, enable land lock sandboxing and restrict process privileges and access."}, {"lang": "es", "value": "Cloud Hypervisor es un Monitor de M\u00e1quina Virtual para cargas de trabajo en la nube. Las versiones 34.0 a 50.0 son vulnerables a la exfiltraci\u00f3n arbitraria de archivos del host (limitada por los privilegios del proceso) al usar dispositivos virtio-block respaldados por im\u00e1genes raw. Un invitado malicioso puede sobrescribir su encabezado de disco con una estructura QCOW2 manipulada que apunta a una ruta sensible del host. Tras el siguiente arranque de la m\u00e1quina virtual o escaneo de disco, la autodetecci\u00f3n del formato de imagen analiza este encabezado y entrega el contenido del archivo del host al invitado. Los reinicios de la m\u00e1quina virtual iniciados por el invitado son suficientes para activar un escaneo de disco y no provocan la salida del proceso de Cloud Hypervisor. Por lo tanto, una \u00fanica m\u00e1quina virtual puede realizar este ataque sin necesidad de interacci\u00f3n de la pila de gesti\u00f3n. La explotaci\u00f3n exitosa requiere que la imagen de respaldo sea escribible por el invitado o que provenga de un origen no confiable. Las implementaciones que utilizan solo im\u00e1genes de confianza y de solo lectura no se ven afectadas. Este problema ha sido solucionado en la versi\u00f3n 50.1. Para una soluci\u00f3n alternativa, habilite el sandboxing de land lock y restrinja los privilegios y el acceso del proceso."}], "id": "CVE-2026-27211", "lastModified": "2026-06-17T10:26:51.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27211", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T21:17:31.615787Z", "version": "2.0.3"}}]}, "published": "2026-02-21T06:17:01.253", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/081a6ebb5184228ff348601502258f3f72bd8b43"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/509832298b6865365b00bda88722e76e41ce7f41"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/a63315df54e06f6ec867f17b63076c266e2d8648"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/cb495959a8bea1b56e8fc82d15ba527a0e7fcf3c"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v50.1"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v51.0"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-jmr4-g2hv-mjj6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[34.0,50.1)"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "cloud-hypervisor", "source": "cna", "vendor": "cloud-hypervisor"}, "product": "cloud_hypervisor", "vendor": "cloudhypervisor"}], "analysis": {"en": {"generated_at": "2026-04-17T16:53:24.061272+00:00", "value": {"mitigation_remediation": ["Upgrade Cloud Hypervisor to version 50.1 or later, which contains the patch for this flaw.", "Enable land lock sandboxing in the hypervisor configuration to isolate guest processes and limit file system access.", "Ensure that guest disk images are either read\u2011only or sourced from trusted, validated origins, and that the images are not writable by the guest."], "summary": {"action": "Patch Immediately", "impact": "Host File Exfiltration"}, "threat_synthesis": {"affected_systems": "The issue affects Cloud Hypervisor versions 34.0 through 50.0 when virtio\u2011block devices use raw image files. Only images that are writable by the guest or derived from an untrusted source enable the attack. Trusted, read\u2011only images are not vulnerable. The vulnerability was identified by the Cloud Hypervisor project and addressed in version 50.1.", "description_and_impact": "An attacker running a malicious virtual machine can manipulate the QCOW2 disk header to point to a file on the host system. When the host VM image is later read by the hypervisor during boot or a disk scan, the host file\u2019s contents are delivered to the guest, effectively allowing the guest to retrieve any file the hypervisor process can access. The vulnerability is an example of CWE\u201173, where a file path is derived from untrusted user input allowing directory traversal or arbitrary file access. The impact is therefore data exfiltration from the host to the guest, potentially exposing sensitive files such as configuration or credential stores, limited by the host process file permissions.", "risk_and_exploitability": "The flaw carries a CVSS score of 9.1, indicating severe risk, but the EPSS score is less than 1\u202f%, suggesting low probability of widespread exploitation at present. It is not listed in the CISA KEV catalog. The attack can be performed with a single boot or reboot of the guest VM, without interacting with the management stack, and the Cloud Hypervisor process does not terminate upon triggering. Thus, the attack vector is a guest\u2011initiated operation exploiting file path dependencies in the hypervisor\u2019s image processing logic."}}}}, "created": "2026-02-23T14:32:39.494109+00:00", "updated": "2026-04-17T17:00:10.184788+00:00", "vendors": ["cloudhypervisor", "cloudhypervisor$PRODUCT$cloud_hypervisor"]}