CVE-2026-63623

Publié : 10 août 2026

Modifié : 10 août 2026

Score CVSS

5.5

MEDIUM

Description détaillée

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Références et Patchs

https://access.redhat.com/security/cve/CVE-2026-63623 https://bugzilla.redhat.com/show_bug.cgi?id=2513066

Dernières Vulnérabilités

CVE-2026-72900

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

VOIR DÉTAILS

CVE-2026-72899

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

VOIR DÉTAILS

CVE-2026-72898

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

VOIR DÉTAILS