CVE-2026-46448
highpriority · track · 34EPSS 0.003 · 20 %ileEUUSEPSS · scored 2026-10-28
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.4–8.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (10)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-mfg3-p6m3-gjgrOpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints2026-06-16ghsa · osvUS
## Affects - Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2 ## Description Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected. ## Patches - https://review.opendev.org/993604 (2025.1/epoxy) - https://review.opendev.org/993603 (2025.2/flamingo) - https://review.opendev.org/993602 (2026.1/gazpacho) - https://review.opendev.org/993601 (2026.2/hibiscus) ## Credits - Erichen from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-46448)
- PYSEC-2026-2686OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints2026-07-13vendor · osvUS
## Affects - Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2 ## Description Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected. ## Patches - https://review.opendev.org/993604 (2025.1/epoxy) - https://review.opendev.org/993603 (2025.2/flamingo) - https://review.opendev.org/993602 (2026.1/gazpacho) - https://review.opendev.org/993601 (2026.2/hibiscus) ## Credits - Erichen from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-46448)
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/06/16/5cnnvd
- https://bugs.launchpad.net/nova/+bug/2151252cnnvd
- https://www.openwall.com/lists/oss-security/2026/06/16/5cnnvd
- https://bugs.launchpad.net/nova/+bug/2151252enisa_euvd
- https://www.openwall.com/lists/oss-security/2026/06/16/5enisa_euvd
- http://www.openwall.com/lists/oss-security/2026/06/16/5Mailing ListThird Party Advisorynvd
- https://bugs.launchpad.net/nova/+bug/2151252ExploitIssue TrackingThird Party Advisorynvd
- https://www.openwall.com/lists/oss-security/2026/06/16/5Mailing ListThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan