Description
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
Published: 2026-08-10
Score: 5.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in libvirt causes storage volume images created during clone or convert operations to be temporarily world-readable. The qemu-img utility sets overly permissive file permissions, allowing any local user to read the full guest disk contents. This weakness is described by CWE-732 and results in a moderate-severity information disclosure vulnerability that can expose data stored in virtual machine disks.

Affected Systems

Red Hat Enterprise Linux 10, 6, 7, 8, 9 and Red Hat Enterprise Linux for NVIDIA 26 are affected. No specific version range is listed; all releases of these products that include the vulnerable libvirt code are impacted.

Risk and Exploitability

The CVSS score is 5.5, indicating a moderate severity. Because a local user can access the temporarily world-readable volume image, the attack vector is local, and the vulnerability could lead to sensitive information disclosure from guest virtual machines. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, so while exploitation is possible, it is not currently widely known or actively exploited.

Generated by OpenCVE AI on August 10, 2026 at 20:12 UTC.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Continuously monitor Red Hat's security advisories for CVE‑2026‑63623 to apply the fix as soon as it becomes available.
  • Keep SELinux in enforcing mode to restrict unauthorized access to the libvirt image directory and other storage paths used by libvirt.
  • Restrict local user permissions to the libvirt image directory, for example by placing it in a group that only libvirt service accounts belong to, and ensure that newly created images do not have world‑readable permissions.
  • No effective CNA-recommended workaround is available; existing options do not meet Red Hat Product Security criteria.

Generated by OpenCVE AI on August 10, 2026 at 20:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 10 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
Title Libvirt: information disclosure via world-readable storage volume images during clone/convert
First Time appeared Redhat
Redhat enterprise Linux
Redhat enterprise Linux Nvidia
Weaknesses CWE-732
CPEs cpe:/a:redhat:enterprise_linux_nvidia:
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat enterprise Linux Nvidia
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Redhat Enterprise Linux Enterprise Linux Nvidia
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-10T21:10:46.846Z

Reserved: 2026-07-17T13:06:13.760Z

Link: CVE-2026-63623

cve-icon Vulnrichment

Updated: 2026-08-10T18:30:30.934Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T20:15:03Z

Weaknesses
  • CWE-732

    Incorrect Permission Assignment for Critical Resource