CVE-2026-63623
Received Received - Intake

Libvirt Storage Volume Clone Information Disclosure

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Red Hat, Inc.

Description
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-63623
EUVD
EUVD-2026-55675

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat libvirt *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

A flaw in libvirt allows temporary world-readable access to newly created storage volume images during clone or convert operations. This happens because qemu-img runs with overly permissive file creation settings, letting any local user read the full contents of guest virtual machine disks.

Detection Guidance

Check for recently created volume images in libvirt storage pools with overly permissive permissions (e.g., world-readable). Use commands like 'ls -l' on storage directories or 'virsh vol-list' to inspect volume permissions. Review audit logs for 'qemu-img' operations during clone/convert tasks.

Impact Analysis

This vulnerability could allow any local user to access sensitive data stored on guest virtual machines, potentially leading to unauthorized information disclosure or data theft from affected systems.

Compliance Impact

This vulnerability may violate compliance requirements such as GDPR or HIPAA by exposing sensitive personal or health data, leading to potential legal and regulatory penalties for affected organizations.

Mitigation Strategies

Immediately verify and correct permissions on all storage volumes created via libvirt operations. Set restrictive permissions (e.g., chmod 600) on affected volumes. Monitor for unauthorized access attempts. Apply any available libvirt or qemu-img patches once released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63623. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart