CVE-2026-46448
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
- Record
CVE-2026-46448- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-669
- Updated
- 2026-11-02
EUVDEUVD-2026-37218
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
- Record
EUVD-2026-37218- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mfg3-p6m3-gjgr
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
Affects
- Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2
Description
Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected.
Patches
- https://review.opendev.org/993604 (2025.1/epoxy)
- https://review.opendev.org/993603 (2025.2/flamingo)
- https://review.opendev.org/993602 (2026.1/gazpacho)
- https://review.opendev.org/993601 (2026.2/hibiscus)
Credits
- Erichen from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-46448)
- Record
GHSA-mfg3-p6m3-gjgr- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-669
- Updated
- 2026-11-02
NVD
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
- Record
CVE-2026-46448- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H - Weakness
- CWE-669
- Updated
- 2026-11-02
OSV
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
- Record
CVE-2026-46448- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-669
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-46448
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
- Record
DEBIAN-CVE-2026-46448- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-mfg3-p6m3-gjgr
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
Affects
- Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2
Description
Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected.
Patches
- https://review.opendev.org/993604 (2025.1/epoxy)
- https://review.opendev.org/993603 (2025.2/flamingo)
- https://review.opendev.org/993602 (2026.1/gazpacho)
- https://review.opendev.org/993601 (2026.2/hibiscus)
Credits
- Erichen from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-46448)
- Record
GHSA-mfg3-p6m3-gjgr- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-669
- Updated
- 2026-11-02
OSVPYSEC-2026-2686
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
Affects
- Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2
Description
Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected.
Patches
- https://review.opendev.org/993604 (2025.1/epoxy)
- https://review.opendev.org/993603 (2025.2/flamingo)
- https://review.opendev.org/993602 (2026.1/gazpacho)
- https://review.opendev.org/993601 (2026.2/hibiscus)
Credits
- Erichen from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-46448)
- Record
PYSEC-2026-2686- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-46448
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
- Record
UBUNTU-CVE-2026-46448- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H - Updated
- 2026-11-02
OSVUSN-8434-1 No score
nova vulnerability
It was discovered that Nova did not strip internal _nova-prefixed scheduler hints supplied by users on instance creation. An attacker could possibly use this issue to bypass Placement resource claims and scheduling constraint enforcement.
- Record
USN-8434-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
novaPyPI |
18.0.0 to 31.3.0 | None known |
novaPyPI |
32.0.0 up to 32.2.1 | 32.2.1 |
novaPyPI |
33.0.0 to 33.0.1 | 33.0.2 |
novaDebian:12 |
All versions, plus listed versions 2:26.1.0-42:26.2.2-1~deb12u32:26.2.2-1~deb12u42:27.0.0-12:27.0.0-2 Show 45 moreShow less2:27.0.0-32:27.0.0-42:27.0.0-52:27.0.0-62:27.0.0~rc1-12:28.0.0-12:28.0.0-22:28.0.0~rc1-12:29.0.0~rc1-12:29.0.1-12:29.0.1-22:29.0.1-32:29.0.1-42:29.0.1-52:29.0.1-62:29.0.2-12:29.0.2-22:29.0.2-42:30.0.0-12:30.0.0-22:30.0.0-32:30.0.0-42:30.0.0-52:30.0.0-62:30.0.0-72:30.0.0-82:30.0.0~rc1-12:31.0.0-12:31.0.0-22:31.0.0-32:31.0.0-42:31.0.0-52:31.0.0-62:31.0.0-72:31.0.0~rc1-12:31.0.0~rc1-22:32.0.0-12:32.0.0~rc1-12:32.0.0~rc1-22:32.0.0~rc1-32:32.1.0-12:32.1.0-22:32.1.0-32:32.1.0-42:32.1.0-5 |
None known |
novaDebian:13 |
All versions, plus listed versions 2:31.0.0-62:31.0.0-6+deb13u12:31.0.0-6+deb13u22:31.0.0-72:32.0.0-1 Show 30 moreShow less2:32.0.0~rc1-12:32.0.0~rc1-22:32.0.0~rc1-32:32.1.0-12:32.1.0-22:32.1.0-32:32.1.0-42:32.1.0-52:32.1.0-62:32.1.0-72:33.0.0-12:33.0.0-22:33.0.0-32:33.0.0-42:33.0.0~rc1-12:33.0.0~rc1-22:33.0.0~rc1-32:33.0.0~rc1-42:33.0.0~rc1-52:33.0.1-12:33.0.1-22:33.0.1-42:33.0.1-52:33.0.2-12:34.0.0-12:34.0.0-22:34.0.0-32:34.0.0-42:34.0.0~rc1-12:34.0.0~rc1-3 |
None known |
novaDebian:14 |
before 2:33.0.1-4, plus listed versions 2:31.0.0-62:31.0.0-72:32.0.0-12:32.0.0~rc1-12:32.0.0~rc1-2 Show 19 moreShow less2:32.0.0~rc1-32:32.1.0-12:32.1.0-22:32.1.0-32:32.1.0-42:32.1.0-52:32.1.0-62:32.1.0-72:33.0.0-12:33.0.0-22:33.0.0-32:33.0.0-42:33.0.0~rc1-12:33.0.0~rc1-22:33.0.0~rc1-32:33.0.0~rc1-42:33.0.0~rc1-52:33.0.1-12:33.0.1-2 |
2:33.0.1-4 |
novaPyPI |
18.0.0 to 31.3.0, plus listed versions 18.0.218.0.318.1.018.2.018.2.1 Show 45 moreShow less18.2.218.2.318.3.019.0.019.0.0.0rc119.0.0.0rc219.0.119.0.219.0.319.1.019.2.019.3.019.3.119.3.220.0.020.0.0.0rc120.0.0.0rc220.0.120.1.020.1.120.2.020.3.020.4.020.4.120.5.020.6.020.6.121.0.021.0.0.0rc121.0.0.0rc221.1.021.1.121.1.221.2.021.2.121.2.221.2.321.2.422.0.022.0.0.0rc122.0.122.1.022.2.022.2.122.2.2 |
None known |
novaPyPI |
32.0.0 up to 32.2.1, plus listed versions 32.1.032.2.0 |
32.2.1 |
novaPyPI |
33.0.0 up to 33.0.2, plus listed versions 33.0.1 |
33.0.2 |
novaPyPI |
18.0.0 up to 31.3.1, 32.0.0 up to 32.2.1, 33.0.0 up to 33.0.2, plus listed versions 18.0.218.0.318.1.018.2.018.2.1 Show 45 moreShow less18.2.218.2.318.3.019.0.019.0.0.0rc119.0.0.0rc219.0.119.0.219.0.319.1.019.2.019.3.019.3.119.3.220.0.020.0.0.0rc120.0.0.0rc220.0.120.1.020.1.120.2.020.3.020.4.020.4.120.5.020.6.020.6.121.0.021.0.0.0rc121.0.0.0rc221.1.021.1.121.1.221.2.021.2.121.2.221.2.321.2.422.0.022.0.0.0rc122.0.122.1.022.2.022.2.122.2.2 |
31.3.132.2.133.0.2 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
novaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:12.0.0-0ubuntu22:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1 Show 19 moreShow less2:13.0.0~rc3-0ubuntu12:13.0.0-0ubuntu12:13.0.0-0ubuntu22:13.0.0-0ubuntu52:13.1.0-0ubuntu12:13.1.1-0ubuntu12:13.1.1-0ubuntu1.12:13.1.2-0ubuntu22:13.1.3-0ubuntu12:13.1.3-0ubuntu22:13.1.4-0ubuntu12:13.1.4-0ubuntu22:13.1.4-0ubuntu32:13.1.4-0ubuntu4.12:13.1.4-0ubuntu4.22:13.1.4-0ubuntu4.32:13.1.4-0ubuntu4.42:13.1.4-0ubuntu4.52:13.1.4-0ubuntu4.5+esm1 |
None known |
novaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:16.0.1-0ubuntu12:16.0.1-0ubuntu22:17.0.0~b1-0ubuntu12:17.0.0~b2-0ubuntu22:17.0.0~b3-0ubuntu3 Show 28 moreShow less2:17.0.0~b3-0ubuntu42:17.0.0~rc1-0ubuntu12:17.0.0~rc2-0ubuntu12:17.0.0~rc3-0ubuntu12:17.0.0-0ubuntu12:17.0.1-0ubuntu12:17.0.3-0ubuntu12:17.0.4-0ubuntu12:17.0.5-0ubuntu12:17.0.5-0ubuntu22:17.0.6-0ubuntu12:17.0.7-0ubuntu12:17.0.7-0ubuntu22:17.0.9-0ubuntu12:17.0.9-0ubuntu32:17.0.10-0ubuntu22:17.0.10-0ubuntu2.12:17.0.11-0ubuntu12:17.0.12-0ubuntu12:17.0.13-0ubuntu12:17.0.13-0ubuntu22:17.0.13-0ubuntu32:17.0.13-0ubuntu42:17.0.13-0ubuntu52:17.0.13-0ubuntu5.22:17.0.13-0ubuntu5.32:17.0.13-0ubuntu5.42:17.0.13-0ubuntu5.4+esm1 |
None known |
novaUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:20.0.0-0ubuntu12:21.0.0~b1~git2019120415.45fb747c98-0ubuntu12:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu22:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu42:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu5 Show 24 moreShow less2:21.0.0~b3~git2020041013.57ff308d6d-0ubuntu22:21.0.0-0ubuntu0.20.04.12:21.0.0-0ubuntu0.20.04.22:21.1.0-0ubuntu12:21.1.1-0ubuntu22:21.1.2-0ubuntu12:21.2.0-0ubuntu12:21.2.1-0ubuntu12:21.2.2-0ubuntu12:21.2.3-0ubuntu12:21.2.4-0ubuntu12:21.2.4-0ubuntu22:21.2.4-0ubuntu2.12:21.2.4-0ubuntu2.22:21.2.4-0ubuntu2.32:21.2.4-0ubuntu2.42:21.2.4-0ubuntu2.52:21.2.4-0ubuntu2.62:21.2.4-0ubuntu2.82:21.2.4-0ubuntu2.112:21.2.4-0ubuntu2.132:21.2.4-0ubuntu2.142:21.2.4-0ubuntu2.14+esm12:21.2.4-0ubuntu2.14+esm2 |
None known |
novaUbuntu:22.04:LTS |
before 3:25.2.1-0ubuntu2.11, plus listed versions 3:24.0.0-0ubuntu13:24.0.0+git2022030310.3f274c65cc-0ubuntu23:25.0.0-0ubuntu13:25.0.0-0ubuntu1.13:25.0.1-0ubuntu1 Show 15 moreShow less3:25.1.0-0ubuntu13:25.1.0-0ubuntu23:25.1.0-0ubuntu2.13:25.1.0-0ubuntu2.23:25.1.1-0ubuntu13:25.1.1-0ubuntu1.13:25.2.0-0ubuntu13:25.2.1-0ubuntu13:25.2.1-0ubuntu23:25.2.1-0ubuntu2.33:25.2.1-0ubuntu2.63:25.2.1-0ubuntu2.73:25.2.1-0ubuntu2.83:25.2.1-0ubuntu2.93:25.2.1-0ubuntu2.10 |
3:25.2.1-0ubuntu2.11 |
novaUbuntu:24.04:LTS |
before 3:29.2.0-0ubuntu1.7, plus listed versions 3:28.0.0-0ubuntu13:28.0.1+git2024011916.087c372a-0ubuntu13:28.0.1+git2024011916.087c372a-0ubuntu23:29.0.0~rc1-0ubuntu23:29.0.1-0ubuntu1 Show 8 moreShow less3:29.0.1-0ubuntu1.33:29.0.1-0ubuntu1.43:29.2.0-0ubuntu13:29.2.0-0ubuntu1.13:29.2.0-0ubuntu1.23:29.2.0-0ubuntu1.33:29.2.0-0ubuntu1.43:29.2.0-0ubuntu1.5 |
3:29.2.0-0ubuntu1.7 |
novaUbuntu:25.10 |
before 3:32.0.0-0ubuntu1.3, plus listed versions 3:31.0.0-0ubuntu13:31.0.0+git2025070714.1c03429337-0ubuntu13:31.0.0+git2025070714.1c03429337-0ubuntu23:32.0.0~rc1-0ubuntu13:32.0.0-0ubuntu13:32.0.0-0ubuntu1.13:32.0.0-0ubuntu1.2 |
3:32.0.0-0ubuntu1.3 |
novaUbuntu:26.04:LTS |
before 3:33.0.0-0ubuntu3.1, plus listed versions 3:32.0.0-0ubuntu13:32.0.0+git20260128.59a7093-0ubuntu13:33.0.0~rc1-0ubuntu13:33.0.0-0ubuntu3 |
3:33.0.0-0ubuntu3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-46448 is a medium vulnerability (CVSS 5.4) in Openstack Nova, published June 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in nova 32.2.1.
References
bugs.launchpad.net/nova/+bug/2151252
openwall.com/lists/oss-security/2026/06/16/5
nvd.nist.gov/vuln/detail/CVE-2026-46448
review.opendev.org/993601
Show 12 moreShow less
github.com/advisories/GHSA-mfg3-p6m3-gjgr
pypi.org/project/nova
security-tracker.debian.org/tracker/CVE-2026-46448
ubuntu.com/security/CVE-2026-46448
cve.org/CVERecord?id=CVE-2026-46448
security.openstack.org/ossa/OSSA-2026-022.html
launchpad.net/bugs/2151252
Left out here: 168 versions. The JSON record has them.