CVE-2026-27211 – Cloud Hypervisor versions 34.0 through 50.0 are... (How to Fix)

Q: What is the severity of CVE-2026-27211?

CVE-2026-27211 has a CVSS score of 10.0 (CRITICAL). Cloud Hypervisor versions 34.0 through 50.0 are vulnerable to host file exfiltration when using virtio-block devices with raw images. A malicious guest can craft a QCOW2 header pointing to sensitive host files, which are then served to the guest upon VM reboot. Only deployments using writable or untrusted backing images are affected.

📋 TL;DR

Cloud Hypervisor versions 34.0 through 50.0 are vulnerable to host file exfiltration when using virtio-block devices with raw images. A malicious guest can craft a QCOW2 header pointing to sensitive host files, which are then served to the guest upon VM reboot. Only deployments using writable or untrusted backing images are affected.

💻 Affected Systems

Products:

Cloud Hypervisor

Versions: 34.0 through 50.0

Operating Systems: Linux

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects deployments using virtio-block devices backed by raw images that are writable by the guest or from untrusted sources.

📦 What is this software?

Cloud Hypervisor by Cloudhypervisor

View all CVEs affecting Cloud Hypervisor →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of sensitive host files accessible to the Cloud Hypervisor process, potentially including configuration files, secrets, or other VMs' data.

🟠

Likely Case

Exfiltration of specific host files that the attacker targets, limited by the hypervisor process privileges and file permissions.

🟢

If Mitigated

No impact if using read-only trusted images or proper sandboxing with restricted privileges.

🌐 Internet-Facing: MEDIUM - Requires a malicious guest VM, which could be deployed by external attackers in cloud environments.

🏢 Internal Only: MEDIUM - Insider threats or compromised internal VMs could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires guest VM compromise or malicious guest deployment. Guest-initiated VM reboot triggers the exploit without hypervisor process restart.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 50.1

Vendor Advisory: https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v50.1

Restart Required: Yes

Instructions:

1. Stop all VMs using Cloud Hypervisor. 2. Update Cloud Hypervisor to version 50.1 or later. 3. Restart Cloud Hypervisor service. 4. Verify the update with 'cloud-hypervisor --version'.

🔧 Temporary Workarounds

Enable Landlock Sandboxing

linux

Restrict Cloud Hypervisor process filesystem access using Landlock LSM to prevent host file access.

Configure Landlock policies to restrict filesystem access for the Cloud Hypervisor process

Use Read-Only Trusted Images

all

Ensure all backing images are from trusted sources and mounted as read-only to guests.

Configure VM disk images with read-only flags and verify image integrity

🧯 If You Can't Patch

Implement strict access controls and privilege separation for Cloud Hypervisor process
Monitor for suspicious guest-initiated VM reboots and disk access patterns

🔍 How to Verify

Check if Vulnerable:

Check Cloud Hypervisor version with 'cloud-hypervisor --version'. If version is between 34.0 and 50.0 inclusive, and using virtio-block with raw images, the system is vulnerable.

Check Version:

cloud-hypervisor --version

Verify Fix Applied:

Verify version is 50.1 or later with 'cloud-hypervisor --version'. Test with known vulnerable configurations to ensure host file access is blocked.

📡 Detection & Monitoring

Log Indicators:

Unexpected guest-initiated VM reboots
Multiple disk format detection events
Access to unusual host file paths in hypervisor logs

Network Indicators:

Unusual data transfer patterns from hypervisor to guest VM

SIEM Query:

source="cloud-hypervisor" AND (event="vm_reboot" OR event="disk_scan") | stats count by vm_id

📊 Metadata

CVE ID: CVE-2026-27211

CVSS v3 Score: 10.0 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CWE: CWE-73

Published: February 21, 2026

Last Updated: February 24, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2026-27211, you might also want to check these: