NOVA · CVE-2026-46448 · Infrastructure
FIX → 33.0.2 · 32.2.1 · 31.3.1
Nova's server create API does not strip internal scheduler hints, so an authenticated user can skip Placement resource claims and scheduling constraints such as availability zone, host aggregate and image trait rules. The resulting instance has no Placement allocation, which can exhaust compute node resources and leave cross-tenant data on NVMe devices after deletion.
first public Jun 16, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Deployments running Nova 18.0.0 or later are affected, with the fix ranges above. Exposure requires an authenticated tenant user who can call the server create API with scheduler hints, so the risk sits inside multi-tenant clouds rather than single-tenant setups. Operators who do not expose server create to untrusted users have lower exposure.
Not affected if single-tenant, unaffected-version
Who cares multi-tenant, nova, openstack, self-hosted
nova package version in the Python environment running the Nova API, for example .Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
pip show nova>=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2.Upgrade to 33.0.2 · 32.2.1 · 31.3.1
nova 32.2.1 for the 32.x linenova 33.0.2 for the 33.x lineGitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.