{"id":"CVE-2026-46448","aliases":["DEBIAN-CVE-2026-46448","EUVD-2026-37218","GHSA-mfg3-p6m3-gjgr","PYSEC-2026-2686","UBUNTU-CVE-2026-46448","USN-8434-1"],"status":"published","title":"OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints","description":"In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00272,"percentile":0.19656,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-669"],"published":"2026-06-16T00:00:00Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"PyPI","package":"nova","fixed_in":["32.2.1","33.0.2","31.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"nova","fixed_in":["2:33.0.1-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nova","fixed_in":["3:25.2.1-0ubuntu2.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nova","fixed_in":["3:29.2.0-0ubuntu1.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"nova","fixed_in":["3:32.0.0-0ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"nova","fixed_in":["3:33.0.0-0ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0.0"},{"last_affected":"31.3.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"32.0.0"},{"fixed":"32.2.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"33.0.0"},{"last_affected":"33.0.1"},{"fixed":"33.0.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:26.1.0-4","2:26.2.2-1~deb12u3","2:26.2.2-1~deb12u4","2:27.0.0-1","2:27.0.0-2","2:27.0.0-3","2:27.0.0-4","2:27.0.0-5","2:27.0.0-6","2:27.0.0~rc1-1","2:28.0.0-1","2:28.0.0-2","2:28.0.0~rc1-1","2:29.0.0~rc1-1","2:29.0.1-1","2:29.0.1-2","2:29.0.1-3","2:29.0.1-4","2:29.0.1-5","2:29.0.1-6","2:29.0.2-1","2:29.0.2-2","2:29.0.2-4","2:30.0.0-1","2:30.0.0-2","2:30.0.0-3","2:30.0.0-4","2:30.0.0-5","2:30.0.0-6","2:30.0.0-7","2:30.0.0-8","2:30.0.0~rc1-1","2:31.0.0-1","2:31.0.0-2","2:31.0.0-3","2:31.0.0-4","2:31.0.0-5","2:31.0.0-6","2:31.0.0-7","2:31.0.0~rc1-1","2:31.0.0~rc1-2","2:32.0.0-1","2:32.0.0~rc1-1","2:32.0.0~rc1-2","2:32.0.0~rc1-3","2:32.1.0-1","2:32.1.0-2","2:32.1.0-3","2:32.1.0-4","2:32.1.0-5","2:32.1.0-6","2:32.1.0-7","2:33.0.0-1","2:33.0.0-2","2:33.0.0-3","2:33.0.0-4","2:33.0.0~rc1-1","2:33.0.0~rc1-2","2:33.0.0~rc1-3","2:33.0.0~rc1-4","2:33.0.0~rc1-5","2:33.0.1-1","2:33.0.1-2","2:33.0.1-4","2:33.0.1-5","2:33.0.2-1","2:34.0.0-1","2:34.0.0-2","2:34.0.0-3","2:34.0.0-4","2:34.0.0~rc1-1","2:34.0.0~rc1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:31.0.0-6","2:31.0.0-6+deb13u1","2:31.0.0-6+deb13u2","2:31.0.0-7","2:32.0.0-1","2:32.0.0~rc1-1","2:32.0.0~rc1-2","2:32.0.0~rc1-3","2:32.1.0-1","2:32.1.0-2","2:32.1.0-3","2:32.1.0-4","2:32.1.0-5","2:32.1.0-6","2:32.1.0-7","2:33.0.0-1","2:33.0.0-2","2:33.0.0-3","2:33.0.0-4","2:33.0.0~rc1-1","2:33.0.0~rc1-2","2:33.0.0~rc1-3","2:33.0.0~rc1-4","2:33.0.0~rc1-5","2:33.0.1-1","2:33.0.1-2","2:33.0.1-4","2:33.0.1-5","2:33.0.2-1","2:34.0.0-1","2:34.0.0-2","2:34.0.0-3","2:34.0.0-4","2:34.0.0~rc1-1","2:34.0.0~rc1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:33.0.1-4"}]}],"versions":["2:31.0.0-6","2:31.0.0-7","2:32.0.0-1","2:32.0.0~rc1-1","2:32.0.0~rc1-2","2:32.0.0~rc1-3","2:32.1.0-1","2:32.1.0-2","2:32.1.0-3","2:32.1.0-4","2:32.1.0-5","2:32.1.0-6","2:32.1.0-7","2:33.0.0-1","2:33.0.0-2","2:33.0.0-3","2:33.0.0-4","2:33.0.0~rc1-1","2:33.0.0~rc1-2","2:33.0.0~rc1-3","2:33.0.0~rc1-4","2:33.0.0~rc1-5","2:33.0.1-1","2:33.0.1-2"]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0.0"},{"last_affected":"31.3.0"}]}],"versions":["18.0.2","18.0.3","18.1.0","18.2.0","18.2.1","18.2.2","18.2.3","18.3.0","19.0.0","19.0.0.0rc1","19.0.0.0rc2","19.0.1","19.0.2","19.0.3","19.1.0","19.2.0","19.3.0","19.3.1","19.3.2","20.0.0","20.0.0.0rc1","20.0.0.0rc2","20.0.1","20.1.0","20.1.1","20.2.0","20.3.0","20.4.0","20.4.1","20.5.0","20.6.0","20.6.1","21.0.0","21.0.0.0rc1","21.0.0.0rc2","21.1.0","21.1.1","21.1.2","21.2.0","21.2.1","21.2.2","21.2.3","21.2.4","22.0.0","22.0.0.0rc1","22.0.1","22.1.0","22.2.0","22.2.1","22.2.2","22.3.0","22.4.0","23.0.0","23.0.0.0rc1","23.0.0.0rc2","23.0.1","23.0.2","23.1.0","23.2.0","23.2.1","23.2.2","24.0.0","24.0.0.0rc1","24.0.0.0rc2","24.1.0","24.1.1","24.2.0","24.2.1","25.0.0","25.0.0.0rc1","25.0.1","25.1.0","25.1.1","25.2.0","25.2.1","25.3.0","26.0.0","26.0.0.0rc1","26.0.0.0rc2","26.1.0","26.1.1","26.2.0","26.2.1","26.2.2","26.3.0","27.0.0","27.0.0.0rc1","27.1.0","27.2.0","27.3.0","27.4.0","27.5.0","27.5.1","28.0.0","28.0.0.0rc1","28.0.1","28.1.0","28.2.0","28.3.0","28.3.1","29.0.0","29.0.0.0rc1","29.0.1","29.0.2","29.1.0","29.2.0","29.2.1","29.2.2","29.3.0","29.4.0","30.0.0","30.0.0.0rc1","30.1.0","30.2.0","30.2.1","30.3.0","31.0.0","31.0.0.0rc1","31.0.1","31.1.0","31.2.0","31.3.0"]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"32.0.0"},{"fixed":"32.2.1"}]}],"versions":["32.0.0","32.1.0","32.2.0"]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"33.0.0"},{"fixed":"33.0.2"}]}],"versions":["33.0.0","33.0.1"]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0.0"},{"fixed":"31.3.1"},{"introduced":"32.0.0"},{"fixed":"32.2.1"},{"introduced":"33.0.0"},{"fixed":"33.0.2"}]}],"versions":["18.0.2","18.0.3","18.1.0","18.2.0","18.2.1","18.2.2","18.2.3","18.3.0","19.0.0","19.0.0.0rc1","19.0.0.0rc2","19.0.1","19.0.2","19.0.3","19.1.0","19.2.0","19.3.0","19.3.1","19.3.2","20.0.0","20.0.0.0rc1","20.0.0.0rc2","20.0.1","20.1.0","20.1.1","20.2.0","20.3.0","20.4.0","20.4.1","20.5.0","20.6.0","20.6.1","21.0.0","21.0.0.0rc1","21.0.0.0rc2","21.1.0","21.1.1","21.1.2","21.2.0","21.2.1","21.2.2","21.2.3","21.2.4","22.0.0","22.0.0.0rc1","22.0.1","22.1.0","22.2.0","22.2.1","22.2.2","22.3.0","22.4.0","23.0.0","23.0.0.0rc1","23.0.0.0rc2","23.0.1","23.0.2","23.1.0","23.2.0","23.2.1","23.2.2","24.0.0","24.0.0.0rc1","24.0.0.0rc2","24.1.0","24.1.1","24.2.0","24.2.1","25.0.0","25.0.0.0rc1","25.0.1","25.1.0","25.1.1","25.2.0","25.2.1","25.3.0","26.0.0","26.0.0.0rc1","26.0.0.0rc2","26.1.0","26.1.1","26.2.0","26.2.1","26.2.2","26.3.0","27.0.0","27.0.0.0rc1","27.1.0","27.2.0","27.3.0","27.4.0","27.5.0","27.5.1","28.0.0","28.0.0.0rc1","28.0.1","28.1.0","28.2.0","28.3.0","28.3.1","29.0.0","29.0.0.0rc1","29.0.1","29.0.2","29.1.0","29.2.0","29.2.1","29.2.2","29.3.0","29.4.0","30.0.0","30.0.0.0rc1","30.1.0","30.2.0","30.2.1","30.3.0","31.0.0","31.0.0.0rc1","31.0.1","31.1.0","31.2.0","31.3.0","32.0.0","32.1.0","32.2.0","33.0.0","33.0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:12.0.0-0ubuntu2","2:13.0.0~b1-0ubuntu1","2:13.0.0~b2-0ubuntu1","2:13.0.0~b3-0ubuntu1","2:13.0.0~rc1-0ubuntu1","2:13.0.0~rc3-0ubuntu1","2:13.0.0-0ubuntu1","2:13.0.0-0ubuntu2","2:13.0.0-0ubuntu5","2:13.1.0-0ubuntu1","2:13.1.1-0ubuntu1","2:13.1.1-0ubuntu1.1","2:13.1.2-0ubuntu2","2:13.1.3-0ubuntu1","2:13.1.3-0ubuntu2","2:13.1.4-0ubuntu1","2:13.1.4-0ubuntu2","2:13.1.4-0ubuntu3","2:13.1.4-0ubuntu4.1","2:13.1.4-0ubuntu4.2","2:13.1.4-0ubuntu4.3","2:13.1.4-0ubuntu4.4","2:13.1.4-0ubuntu4.5","2:13.1.4-0ubuntu4.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:16.0.1-0ubuntu1","2:16.0.1-0ubuntu2","2:17.0.0~b1-0ubuntu1","2:17.0.0~b2-0ubuntu2","2:17.0.0~b3-0ubuntu3","2:17.0.0~b3-0ubuntu4","2:17.0.0~rc1-0ubuntu1","2:17.0.0~rc2-0ubuntu1","2:17.0.0~rc3-0ubuntu1","2:17.0.0-0ubuntu1","2:17.0.1-0ubuntu1","2:17.0.3-0ubuntu1","2:17.0.4-0ubuntu1","2:17.0.5-0ubuntu1","2:17.0.5-0ubuntu2","2:17.0.6-0ubuntu1","2:17.0.7-0ubuntu1","2:17.0.7-0ubuntu2","2:17.0.9-0ubuntu1","2:17.0.9-0ubuntu3","2:17.0.10-0ubuntu2","2:17.0.10-0ubuntu2.1","2:17.0.11-0ubuntu1","2:17.0.12-0ubuntu1","2:17.0.13-0ubuntu1","2:17.0.13-0ubuntu2","2:17.0.13-0ubuntu3","2:17.0.13-0ubuntu4","2:17.0.13-0ubuntu5","2:17.0.13-0ubuntu5.2","2:17.0.13-0ubuntu5.3","2:17.0.13-0ubuntu5.4","2:17.0.13-0ubuntu5.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:20.0.0-0ubuntu1","2:21.0.0~b1~git2019120415.45fb747c98-0ubuntu1","2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu2","2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu4","2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu5","2:21.0.0~b3~git2020041013.57ff308d6d-0ubuntu2","2:21.0.0-0ubuntu0.20.04.1","2:21.0.0-0ubuntu0.20.04.2","2:21.1.0-0ubuntu1","2:21.1.1-0ubuntu2","2:21.1.2-0ubuntu1","2:21.2.0-0ubuntu1","2:21.2.1-0ubuntu1","2:21.2.2-0ubuntu1","2:21.2.3-0ubuntu1","2:21.2.4-0ubuntu1","2:21.2.4-0ubuntu2","2:21.2.4-0ubuntu2.1","2:21.2.4-0ubuntu2.2","2:21.2.4-0ubuntu2.3","2:21.2.4-0ubuntu2.4","2:21.2.4-0ubuntu2.5","2:21.2.4-0ubuntu2.6","2:21.2.4-0ubuntu2.8","2:21.2.4-0ubuntu2.11","2:21.2.4-0ubuntu2.13","2:21.2.4-0ubuntu2.14","2:21.2.4-0ubuntu2.14+esm1","2:21.2.4-0ubuntu2.14+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:25.2.1-0ubuntu2.11"}]}],"versions":["3:24.0.0-0ubuntu1","3:24.0.0+git2022030310.3f274c65cc-0ubuntu2","3:25.0.0-0ubuntu1","3:25.0.0-0ubuntu1.1","3:25.0.1-0ubuntu1","3:25.1.0-0ubuntu1","3:25.1.0-0ubuntu2","3:25.1.0-0ubuntu2.1","3:25.1.0-0ubuntu2.2","3:25.1.1-0ubuntu1","3:25.1.1-0ubuntu1.1","3:25.2.0-0ubuntu1","3:25.2.1-0ubuntu1","3:25.2.1-0ubuntu2","3:25.2.1-0ubuntu2.3","3:25.2.1-0ubuntu2.6","3:25.2.1-0ubuntu2.7","3:25.2.1-0ubuntu2.8","3:25.2.1-0ubuntu2.9","3:25.2.1-0ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:29.2.0-0ubuntu1.7"}]}],"versions":["3:28.0.0-0ubuntu1","3:28.0.1+git2024011916.087c372a-0ubuntu1","3:28.0.1+git2024011916.087c372a-0ubuntu2","3:29.0.0~rc1-0ubuntu2","3:29.0.1-0ubuntu1","3:29.0.1-0ubuntu1.3","3:29.0.1-0ubuntu1.4","3:29.2.0-0ubuntu1","3:29.2.0-0ubuntu1.1","3:29.2.0-0ubuntu1.2","3:29.2.0-0ubuntu1.3","3:29.2.0-0ubuntu1.4","3:29.2.0-0ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:32.0.0-0ubuntu1.3"}]}],"versions":["3:31.0.0-0ubuntu1","3:31.0.0+git2025070714.1c03429337-0ubuntu1","3:31.0.0+git2025070714.1c03429337-0ubuntu2","3:32.0.0~rc1-0ubuntu1","3:32.0.0-0ubuntu1","3:32.0.0-0ubuntu1.1","3:32.0.0-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:33.0.0-0ubuntu3.1"}]}],"versions":["3:32.0.0-0ubuntu1","3:32.0.0+git20260128.59a7093-0ubuntu1","3:33.0.0~rc1-0ubuntu1","3:33.0.0-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:25.2.1-0ubuntu2.11"}]}],"versions":["3:24.0.0-0ubuntu1","3:24.0.0+git2022030310.3f274c65cc-0ubuntu2","3:25.0.0-0ubuntu1","3:25.0.0-0ubuntu1.1","3:25.0.1-0ubuntu1","3:25.1.0-0ubuntu1","3:25.1.0-0ubuntu2","3:25.1.0-0ubuntu2.1","3:25.1.0-0ubuntu2.2","3:25.1.1-0ubuntu1","3:25.1.1-0ubuntu1.1","3:25.2.0-0ubuntu1","3:25.2.1-0ubuntu1","3:25.2.1-0ubuntu2","3:25.2.1-0ubuntu2.3","3:25.2.1-0ubuntu2.6","3:25.2.1-0ubuntu2.7","3:25.2.1-0ubuntu2.8","3:25.2.1-0ubuntu2.9","3:25.2.1-0ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:29.2.0-0ubuntu1.7"}]}],"versions":["3:28.0.0-0ubuntu1","3:28.0.1+git2024011916.087c372a-0ubuntu1","3:28.0.1+git2024011916.087c372a-0ubuntu2","3:29.0.0~rc1-0ubuntu2","3:29.0.1-0ubuntu1","3:29.0.1-0ubuntu1.3","3:29.0.1-0ubuntu1.4","3:29.2.0-0ubuntu1","3:29.2.0-0ubuntu1.1","3:29.2.0-0ubuntu1.2","3:29.2.0-0ubuntu1.3","3:29.2.0-0ubuntu1.4","3:29.2.0-0ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:32.0.0-0ubuntu1.3"}]}],"versions":["3:31.0.0-0ubuntu1","3:31.0.0+git2025070714.1c03429337-0ubuntu1","3:31.0.0+git2025070714.1c03429337-0ubuntu2","3:32.0.0~rc1-0ubuntu1","3:32.0.0-0ubuntu1","3:32.0.0-0ubuntu1.1","3:32.0.0-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:33.0.0-0ubuntu3.1"}]}],"versions":["3:32.0.0-0ubuntu1","3:32.0.0+git20260128.59a7093-0ubuntu1","3:33.0.0~rc1-0ubuntu1","3:33.0.0-0ubuntu3"]}],"products":[{"vendor":"openstack","product":"nova"}],"references":[{"url":"https://bugs.launchpad.net/nova/+bug/2151252","tags":["exploit","Exploit","Issue Tracking","Third Party Advisory","web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/16/5","tags":["Mailing List","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/16/5","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46448","tags":["advisory"]},{"url":"https://review.opendev.org/993601","tags":["web"]},{"url":"https://review.opendev.org/993602","tags":["web"]},{"url":"https://review.opendev.org/993603","tags":["web"]},{"url":"https://review.opendev.org/993604","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mfg3-p6m3-gjgr","tags":["advisory"]},{"url":"https://github.com/openstack/nova","tags":["package"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2026-2686.yaml","tags":["web"]},{"url":"https://pypi.org/project/nova","tags":["web","package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46448.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-46448","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-46448","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46448","tags":["report"]},{"url":"https://security.openstack.org/ossa/OSSA-2026-022.html","tags":["report"]},{"url":"https://launchpad.net/bugs/2151252","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8434-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-46448","description":"In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.","status":"published","published":"2026-06-16T00:00:00Z","modified":"2026-06-17T12:17:30.606Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T13:46:55.086623Z"}],"euvd":[{"id":"EUVD-2026-37218","description":"In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.","status":"published","published":"2026-06-16T00:00:00Z","modified":"2026-06-17T12:17:30Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:38.883875Z"}],"ghsa":[{"id":"GHSA-mfg3-p6m3-gjgr","title":"OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints","description":"## Affects\n\n- Nova: \u003e=18.0.0 \u003c31.3.1, \u003e=32.0.0 \u003c32.2.1, \u003e=33.0.0 \u003c33.0.2\n\n\n## Description\nErichen from the Institute of Computing Technology, Chinese Academy of \nSciences reported that Nova's server create API does not strip internal \nscheduler hints. An authenticated user can bypass Placement resource \nclaims and scheduling constraint enforcement, including availability \nzone, host aggregate, and image trait restrictions. The resulting \ninstance has no Placement allocation, which can lead to compute node \nresource exhaustion and cross-tenant data persistence on NVMe devices \nafter instance deletion. Deployments running Nova 18.0.0 or later are \naffected.\n\n\n\n## Patches\n\n- https://review.opendev.org/993604 (2025.1/epoxy)\n- https://review.opendev.org/993603 (2025.2/flamingo)\n- https://review.opendev.org/993602 (2026.1/gazpacho)\n- https://review.opendev.org/993601 (2026.2/hibiscus)\n\n\n## Credits\n- Erichen from Institute of Computing Technology, Chinese Academy of \nSciences (CVE-2026-46448)","status":"published","published":"2026-06-16T21:32:01Z","modified":"2026-07-21T15:04:07Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:40:49.410128Z"}],"nvd":[{"id":"CVE-2026-46448","description":"In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.","status":"published","published":"2026-06-16T20:16:41.697Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:12:24.19758Z"}],"osv":[{"id":"CVE-2026-46448","description":"In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.","status":"published","published":"2026-06-16T00:00:00Z","modified":"2026-10-28T02:30:42.03284559Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T15:45:05.870292Z"},{"id":"DEBIAN-CVE-2026-46448","description":"In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.","status":"published","published":"2026-06-16T20:16:41.697Z","modified":"2026-10-26T12:02:57.550564116Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:56.025495Z"},{"id":"GHSA-mfg3-p6m3-gjgr","title":"OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints","description":"## Affects\n\n- Nova: \u003e=18.0.0 \u003c31.3.1, \u003e=32.0.0 \u003c32.2.1, \u003e=33.0.0 \u003c33.0.2\n\n\n## Description\nErichen from the Institute of Computing Technology, Chinese Academy of \nSciences reported that Nova's server create API does not strip internal \nscheduler hints. An authenticated user can bypass Placement resource \nclaims and scheduling constraint enforcement, including availability \nzone, host aggregate, and image trait restrictions. The resulting \ninstance has no Placement allocation, which can lead to compute node \nresource exhaustion and cross-tenant data persistence on NVMe devices \nafter instance deletion. Deployments running Nova 18.0.0 or later are \naffected.\n\n\n\n## Patches\n\n- https://review.opendev.org/993604 (2025.1/epoxy)\n- https://review.opendev.org/993603 (2025.2/flamingo)\n- https://review.opendev.org/993602 (2026.1/gazpacho)\n- https://review.opendev.org/993601 (2026.2/hibiscus)\n\n\n## Credits\n- Erichen from Institute of Computing Technology, Chinese Academy of \nSciences (CVE-2026-46448)","status":"published","published":"2026-06-16T21:32:01Z","modified":"2026-09-10T03:51:09.100402114Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"PYSEC-2026-2686","title":"OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints","description":"## Affects\n\n- Nova: \u003e=18.0.0 \u003c31.3.1, \u003e=32.0.0 \u003c32.2.1, \u003e=33.0.0 \u003c33.0.2\n\n\n## Description\nErichen from the Institute of Computing Technology, Chinese Academy of \nSciences reported that Nova's server create API does not strip internal \nscheduler hints. An authenticated user can bypass Placement resource \nclaims and scheduling constraint enforcement, including availability \nzone, host aggregate, and image trait restrictions. The resulting \ninstance has no Placement allocation, which can lead to compute node \nresource exhaustion and cross-tenant data persistence on NVMe devices \nafter instance deletion. Deployments running Nova 18.0.0 or later are \naffected.\n\n\n\n## Patches\n\n- https://review.opendev.org/993604 (2025.1/epoxy)\n- https://review.opendev.org/993603 (2025.2/flamingo)\n- https://review.opendev.org/993602 (2026.1/gazpacho)\n- https://review.opendev.org/993601 (2026.2/hibiscus)\n\n\n## Credits\n- Erichen from Institute of Computing Technology, Chinese Academy of \nSciences (CVE-2026-46448)","status":"published","published":"2026-07-13T15:46:18.433999Z","modified":"2026-07-13T16:32:17.576795152Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"UBUNTU-CVE-2026-46448","description":"In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.","status":"published","published":"2026-06-16T00:00:00Z","modified":"2026-06-29T13:50:31.619452472Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"},{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:30.797112Z"},{"id":"USN-8434-1","title":"nova vulnerability","description":"It was discovered that Nova did not strip internal _nova-prefixed\nscheduler hints supplied by users on instance creation. An attacker could\npossibly use this issue to bypass Placement resource claims and\nscheduling constraint enforcement.","status":"published","published":"2026-06-16T14:45:58Z","modified":"2026-06-29T13:51:19.686344088Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}