{
"id": "GHSA-mfg3-p6m3-gjgr",
"aliases": [
"CVE-2026-46448"
],
"details": "## Affects\n\n- Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2\n\n\n## Description\nErichen from the Institute of Computing Technology, Chinese Academy of \nSciences reported that Nova's server create API does not strip internal \nscheduler hints. An authenticated user can bypass Placement resource \nclaims and scheduling constraint enforcement, including availability \nzone, host aggregate, and image trait restrictions. The resulting \ninstance has no Placement allocation, which can lead to compute node \nresource exhaustion and cross-tenant data persistence on NVMe devices \nafter instance deletion. Deployments running Nova 18.0.0 or later are \naffected.\n\n\n\n## Patches\n\n- https://review.opendev.org/993604 (2025.1/epoxy)\n- https://review.opendev.org/993603 (2025.2/flamingo)\n- https://review.opendev.org/993602 (2026.1/gazpacho)\n- https://review.opendev.org/993601 (2026.2/hibiscus)\n\n\n## Credits\n- Erichen from Institute of Computing Technology, Chinese Academy of \nSciences (CVE-2026-46448)",
"summary": "OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "18.0.0"
},
{
"last_affected": "31.3.0"
}
]
}
],
"package": {
"name": "nova",
"ecosystem": "PyPI"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "32.0.0"
},
{
"fixed": "32.2.1"
}
]
}
],
"package": {
"name": "nova",
"ecosystem": "PyPI"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "33.0.0"
},
{
"fixed": "33.0.2"
}
]
}
],
"package": {
"name": "nova",
"ecosystem": "PyPI"
},
"database_specific": {
"last_known_affected_version_range": "<= 33.0.1"
}
}
],
"modified": "2026-07-21T15:04:06Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
}
],
"published": "2026-06-16T21:32:01Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46448",
"type": "ADVISORY"
},
{
"url": "https://bugs.launchpad.net/nova/+bug/2151252",
"type": "WEB"
},
{
"url": "https://github.com/advisories/GHSA-mfg3-p6m3-gjgr",
"type": "ADVISORY"
},
{
"url": "https://github.com/openstack/nova",
"type": "PACKAGE"
},
{
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2026-2686.yaml",
"type": "WEB"
},
{
"url": "https://pypi.org/project/nova",
"type": "WEB"
},
{
"url": "https://review.opendev.org/993601",
"type": "WEB"
},
{
"url": "https://review.opendev.org/993602",
"type": "WEB"
},
{
"url": "https://review.opendev.org/993603",
"type": "WEB"
},
{
"url": "https://review.opendev.org/993604",
"type": "WEB"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/06/16/5",
"type": "WEB"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/06/16/5",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2026-06-16T20:16:41Z",
"github_reviewed_at": "2026-06-17T18:39:21Z"
}
}