medium5.4
CVE-2026-46448
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
Impact
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | nova | >= 18.0.0, <= 31.3.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openstack | Nova | from 18.0.0 before 31.3.1 from 32.0.0 before 32.2.1 from 33.0.0 before 33.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-mfg3-p6m3-gjgr
- https://nvd.nist.gov/vuln/detail/CVE-2026-46448
- https://bugs.launchpad.net/nova/+bug/2151252
- https://www.openwall.com/lists/oss-security/2026/06/16/5
- http://www.openwall.com/lists/oss-security/2026/06/16/5
- https://review.opendev.org/993601
- https://review.opendev.org/993602
- https://review.opendev.org/993603
- https://review.opendev.org/993604
- https://github.com/openstack/nova
- https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2026-2686.yaml
- https://pypi.org/project/nova