Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-27211

Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. Versions 34.0 through 50.0 arevulnerable to arbitrary host file exfiltration (constrained by process privileges) when using virtio-block devices backed by raw images. A malicious guest can overwrite its disk header with a crafted QCOW2 structure pointing to a sensitive host path. Upon the next VM boot or disk scan, the image format auto-detection parses this header and serves the host file's contents to the guest. Guest-initiated
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:fdd144221dd819f4d16b9867b6300537defe1ae85c8a7838b9ed3e161ccb327a
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"cloud-hypervisor","vendor":"cloud-hypervisor","versions":[{"status":"affected","version":">= 34.0, < 50.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5396b233605b25233770b976615fb1f0b135dcbeecc6fda1778ce35d3bf90bf4 · sha256:6d53ea9907496289… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":9.1,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:5396b233605b25233770b976615fb1f0b135dcbeecc6fda1778ce35d3bf90bf4 · sha256:6d53ea9907496289… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-73","description":"CWE-73: External Control of File Name or Path","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:5396b233605b25233770b976615fb1f0b135dcbeecc6fda1778ce35d3bf90bf4 · sha256:6d53ea9907496289… · /containers/cna/problemTypes/0/descriptions/0

Source references

7 source assertions
{"name":"https://github.com/cloud-hypervisor/cloud-hypervisor/commit/081a6ebb5184228ff348601502258f3f72bd8b43","tags":["x_refsource_MISC"],"url":"https://github.com/cloud-hypervisor/cloud-hypervisor/commit/081a6ebb5184228ff348601502258f3f72bd8b43"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5396b233605b25233770b976615fb1f0b135dcbeecc6fda1778ce35d3bf90bf4 · sha256:6d53ea9907496289… · /containers/cna/references/1
{"name":"https://github.com/cloud-hypervisor/cloud-hypervisor/commit/509832298b6865365b00bda88722e76e41ce7f41","tags":["x_refsource_MISC"],"url":"https://github.com/cloud-hypervisor/cloud-hypervisor/commit/509832298b6865365b00bda88722e76e41ce7f41"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5396b233605b25233770b976615fb1f0b135dcbeecc6fda1778ce35d3bf90bf4 · sha256:6d53ea9907496289… · /containers/cna/references/2
{"name":"https://github.com/cloud-hypervisor/cloud-hypervisor/commit/a63315df54e06f6ec867f17b63076c266e2d8648","tags":["x_refsource_MISC"],"url":"https://github.com/cloud-hypervisor/cloud-hypervisor/commit/a63315df54e06f6ec867f17b63076c266e2d8648"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5396b233605b25233770b976615fb1f0b135dcbeecc6fda1778ce35d3bf90bf4 · sha256:6d53ea9907496289… · /containers/cna/references/3
{"name":"https://github.com/cloud-hypervisor/cloud-hypervisor/commit/cb495959a8bea1b56e8fc82d15ba527a0e7fcf3c","tags":["x_refsource_MISC"],"url":"https://github.com/cloud-hypervisor/cloud-hypervisor/commit/cb495959a8bea1b56e8fc82d15ba527a0e7fcf3c"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5396b233605b25233770b976615fb1f0b135dcbeecc6fda1778ce35d3bf90bf4 · sha256:6d53ea9907496289… · /containers/cna/references/4
{"name":"https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v50.1","tags":["x_refsource_MISC"],"url":"https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v50.1"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5396b233605b25233770b976615fb1f0b135dcbeecc6fda1778ce35d3bf90bf4 · sha256:6d53ea9907496289… · /containers/cna/references/5
{"name":"https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v51.0","tags":["x_refsource_MISC"],"url":"https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v51.0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5396b233605b25233770b976615fb1f0b135dcbeecc6fda1778ce35d3bf90bf4 · sha256:6d53ea9907496289… · /containers/cna/references/6
{"name":"https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-jmr4-g2hv-mjj6","tags":["x_refsource_CONFIRM"],"url":"https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-jmr4-g2hv-mjj6"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5396b233605b25233770b976615fb1f0b135dcbeecc6fda1778ce35d3bf90bf4 · sha256:6d53ea9907496289… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer