CVE-2024-0822 is a high severity (CVSS 7.5) authentication bypass in ovirt-engine. A flaw in the CreateUserSession command allows users to be created without authentication. Apply the vendor fix from Red Hat advisory RHSA-2024:0934 or the upstream change, and review user accounts.
What's affected
ovirt-engine. The CPE entry has no version bounds. The record says the CreateUserSession command has a flaw that allows creating users in the system without authentication.
References include Red Hat advisory RHSA-2024:0934, a Red Hat CVE page, a Bugzilla entry and upstream pull request 914 in the oVirt engine repository. Exact fixed package versions depend on your product stream, so read the advisory.
The record classifies the weakness as CWE-1390 (weak authentication) and CWE-287 (improper authentication). NVD scores it 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
How to check if you're exposed
Check the installed engine package version on the manager host and compare it with the advisory:
rpm -q ovirt-engine
On Red Hat based products, the name of the shipped package can differ, so use the product documentation. Then list users in the administration portal and look for accounts you did not create.
What to do now
- Read RHSA-2024:0934 and install the update for your product stream.
- Review the user list in the engine and remove unknown accounts and any permissions granted to them.
- Restrict network access to the engine's management interface to administrative networks.
- Review audit logs for user creation events you cannot match to a change.
Why it matters
The record lists CWE-287 and CWE-1390 for this flaw. Both describe authentication that can be bypassed or is weaker than intended. A virtualisation manager is a high value target, since account creation inside it can lead to control over virtual machines.
The score is high rather than critical because the record's vector shows integrity impact only. Even so, unauthenticated user creation is the first step toward more.
Two habits help with issues of this kind. First, keep a current inventory that records which machines run the product and which version, so a new advisory becomes a quick query instead of a hunt. Second, write down the owner of each system. Many fixes slip because nobody was sure who could approve the downtime. The free in-browser dependency scan at the scan page covers the application dependencies in your repositories, and the Gold directory lists known vulnerabilities by CVE, so you can see related entries for the same product.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Does the record say this is exploited?
No. It is not in CISA's KEV list, and nothing in the record claims exploitation.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- github.com
- Safeguard Gold entry for CVE-2024-0822
Last reviewed: 19 October 2026.
