Correction: the fixed release is 1.2.1 release-pipeline: https://gitlab.com/yaook/operator/-/pipelines/2332251028 On Tue, 2026-02-17 at 18:24 +0100, Stefan Hoffmann via Yaook wrote:
Hi,
today OpenStack announced that there is a CVE at nova, when using flat image backend [1]. We have further information at our Advisory [2].
If you DON'T have `use_cow_images=False` configured in nova.conf you should be not affected.
To mitigate this issue, upgrade to yaook release v1.3.0 (will be released tomorrow) or pin the nova-compute image at nova-operator like described here[2] to registry.yaook.cloud/yaook/nova-compute-2025.1- ubuntu:4.1.183
Best regards Stefan
[1] https://security.openstack.org/ossa/OSSA-2026-002.html [2] https://yaook.cloud/security-advisories-cve-2026-24708/