PT-2026-21357 · Unknown · Cloud Hypervisor

Demimarie · Published 2026-02-21 · Updated 2026-03-03 · CVE-2026-27211

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cloud Hypervisor versions 34.0 through 50.0

Description Cloud Hypervisor, a Virtual Machine Monitor for Cloud workloads, has an issue where a malicious guest can potentially access sensitive host files. This occurs when using virtio-block devices with raw images. The guest can modify its disk header to include a crafted QCOW2 structure that points to a sensitive file on the host system. When the VM boots or a disk scan occurs, the image format detection process can then serve the contents of the host file to the guest. A guest-initiated reboot is enough to trigger the disk scan. Exploitation requires the backing image to be writable by the guest or sourced from an untrusted location.

Recommendations Versions prior to 50.1 should be updated. Enable land lock sandboxing. Restrict process privileges and access.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

AZL-78282

CVE-2026-27211

GHSA-JMR4-G2HV-MJJ6

Affected Products

Cloud Hypervisor

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27211.json · Exploit
• https://github.com/cloud-hypervisor/cloud-hypervisor/commit/509832298b6865365b00bda88722e76e41ce7f41 · Patch
• https://github.com/cloud-hypervisor/cloud-hypervisor/commit/cb495959a8bea1b56e8fc82d15ba527a0e7fcf3c · Patch
• https://github.com/cloud-hypervisor/cloud-hypervisor/commit/a63315df54e06f6ec867f17b63076c266e2d8648 · Patch
• https://github.com/cloud-hypervisor/cloud-hypervisor/commit/081a6ebb5184228ff348601502258f3f72bd8b43 · Patch
• https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-jmr4-g2hv-mjj6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27211 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27211 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-78282 · Vendor Advisory
• https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v50.1 · Note
• https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v51.0 · Note
• https://twitter.com/AgniOpsIn/status/2028671145223065662 · Twitter Post
• https://t.me/cveNotify/152700 · Telegram Post
• https://twitter.com/CVEnew/status/2025154187596566587 · Twitter Post
• https://t.me/cveNotify/153021 · Telegram Post