{"id":"CVE-2026-46448","kind":"vulnerability","aliases":["CVE-2026-46448","GHSA-mfg3-p6m3-gjgr"],"related":[],"title":"OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints","description":"## Affects\n\n- Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2\n\n\n## Description\nErichen from the Institute of Computing Technology, Chinese Academy of \nSciences reported that Nova's server create API does not strip internal \nscheduler hints. An authenticated user can bypass Placement resource \nclaims and scheduling constraint enforcement, including availability \nzone, host aggregate, and image trait restrictions. The resulting \ninstance has no Placement allocation, which can lead to compute node \nresource exhaustion and cross-tenant data persistence on NVMe devices \nafter instance deletion. Deployments running Nova 18.0.0 or later are \naffected.\n\n\n\n## Patches\n\n- https://review.opendev.org/993604 (2025.1/epoxy)\n- https://review.opendev.org/993603 (2025.2/flamingo)\n- https://review.opendev.org/993602 (2026.1/gazpacho)\n- https://review.opendev.org/993601 (2026.2/hibiscus)\n\n\n## Credits\n- Erichen from Institute of Computing Technology, Chinese Academy of \nSciences (CVE-2026-46448)","summary":"Nova's server create API does not strip internal scheduler hints, so an authenticated user can skip Placement resource claims and scheduling constraints such as availability zone, host aggregate and image trait rules. The resulting instance has no Placement allocation, which can exhaust compute node resources and leave cross-tenant data on NVMe devices after deletion.","severity":"high","cvss":8.5,"epss":0.00272,"exploited":false,"exploited_at":null,"products":[{"name":"nova","fixed":[],"affected":">= 18.0.0, <= 31.3.0","ecosystem":"pypi"},{"name":"nova","fixed":["32.2.1"],"affected":">= 32.0.0, < 32.2.1","ecosystem":"pypi"},{"name":"nova","fixed":["33.0.2"],"affected":">= 33.0.0, <= 33.0.1","ecosystem":"pypi"},{"name":"openstack nova","fixed":["31.3.1"],"affected":">= 18.0.0, < 31.3.1","ecosystem":"vendor"},{"name":"openstack nova","fixed":["32.2.1"],"affected":">= 32.0.0, < 32.2.1","ecosystem":"vendor"},{"name":"openstack nova","fixed":["33.0.2"],"affected":">= 33.0.0, < 33.0.2","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-669","infrastructure","multi-tenant","nova","openstack","self-hosted"],"not_affected_if":["single-tenant","unaffected-version"],"how_to_check":"- Check the installed `nova` package version in the Python environment running the Nova API, for example `pip show nova`.\n- Compare it against the affected ranges: `>=18.0.0 <31.3.1`, `>=32.0.0 <32.2.1`, `>=33.0.0 <33.0.2`.","fix":"- `nova` `32.2.1` for the 32.x line\n- `nova` `33.0.2` for the 33.x line\n- For 18.0.0 through 31.x, the sources give a patched backport at review 993604 for 2025.1 (epoxy) but no explicit fixed version for the 31.x line; the product data lists no fixed version for that range.","status":"open","published_at":"2026-06-16T20:16:41+00:00","first_seen_at":"2026-11-13T00:35:02+00:00","triaged_at":"2026-11-13T00:37:01+00:00","updated_at":"2026-11-13T00:41:07+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T00:37:01Z","model":"claude-haiku-5-5","output":{"fix":"- `nova` `32.2.1` for the 32.x line\n- `nova` `33.0.2` for the 33.x line\n- For 18.0.0 through 31.x, the sources give a patched backport at review 993604 for 2025.1 (epoxy) but no explicit fixed version for the 31.x line; the product data lists no fixed version for that range.","reach":"network","title":"OpenStack Nova: scheduler hints in server create bypass placement and scheduling limits","impact":"medium","summary":"Nova's server create API does not strip internal scheduler hints, so an authenticated user can skip Placement resource claims and scheduling constraints such as availability zone, host aggregate and image trait rules. The resulting instance has no Placement allocation, which can exhaust compute node resources and leave cross-tenant data on NVMe devices after deletion.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openstack","nova","self-hosted","multi-tenant"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"tenant bypasses placement limits and reads leftover data on NVMe","analyst_note":"The 18.x to 31.x fixed version is not stated in the product data; check the Nova release notes or review 993604 to find the 31.x fix.","how_to_check":"- Check the installed `nova` package version in the Python environment running the Nova API, for example `pip show nova`.\n- Compare it against the affected ranges: `>=18.0.0 <31.3.1`, `>=32.0.0 <32.2.1`, `>=33.0.0 <33.0.2`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-tenant","unaffected-version"],"who_is_affected":"Deployments running Nova 18.0.0 or later are affected, with the fix ranges above. Exposure requires an authenticated tenant user who can call the server create API with scheduler hints, so the risk sits inside multi-tenant clouds rather than single-tenant setups. Operators who do not expose server create to untrusted users have lower exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000887,"input_tokens":5003,"output_tokens":774,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A,224C '-46448':16A,24A,225C '-669':35B '/993601':209C '/993602':204C '/993603':199C '/993604':194C '/epoxy':196C '/flamingo':201C '/gazpacho':206C '/hibiscus':211C '18.0.0':104C,186C '2025.1':195C '2025.2':200C '2026.1':205C '2026.2':210C '31.3.1':105C '32.0.0':106C '32.2.1':107C '33.0.0':108C '33.0.2':109C 'academi':119C,220C 'affect':102C,190C 'aggreg':73B,151C 'alloc':84B,162C 'api':49B,128C 'authent':58B,136C 'avail':70B,148C 'bypass':7A,139C 'chines':118C,219C 'claim':10A,64B,142C 'comput':88B,116C,167C,217C 'constraint':13A,67B,145C 'creat':48B,127C 'credit':212C 'cross':94B,173C 'cross-ten':93B,172C 'cve':14A,22A,223C 'cwe':34B 'data':96B,175C 'delet':101B,182C 'deploy':183C 'descript':110C 'devic':99B,179C 'enforc':146C 'erichen':111C,213C 'exhaust':87B,170C 'ghsa':18A 'ghsa-mfg3-p6m3-gjgr':17A 'gjgr':21A 'hint':5A,55B,134C 'host':44B,72B,150C 'imag':75B,153C 'includ':147C 'infrastructur':36B 'inject':6A 'instanc':80B,158C,181C 'institut':114C,215C 'intern':53B,132C 'later':188C 'lead':165C 'leav':92B 'mfg3':19A 'multi':38B 'multi-ten':37B 'node':89B,168C 'nova':2A,3A,25A,26A,27A,29A,31A,33A,40B,45B,103C,124C,185C 'nvme':98B,178C 'openstack':1A,28A,30A,32A,41B 'p6m3':20A 'patch':191C 'persist':176C 'placement':8A,62B,83B,140C,161C 'report':122C 'resourc':9A,63B,90B,141C,169C 'restrict':155C 'result':79B,157C 'review.opendev.org':193C,198C,203C,208C 'review.opendev.org/993601':207C 'review.opendev.org/993602':202C 'review.opendev.org/993603':197C 'review.opendev.org/993604':192C 'rule':77B 'run':184C 'schedul':4A,12A,54B,66B,133C,144C 'scienc':121C,222C 'self':43B 'self-host':42B 'server':47B,126C 'skip':61B 'strip':52B,131C 'technolog':117C,218C 'tenant':39B,95B,174C 'trait':76B,154C 'user':59B,137C 'zone':71B,149C","nicknames":[],"mitigations":[],"who_affected":"Deployments running Nova 18.0.0 or later are affected, with the fix ranges above. Exposure requires an authenticated tenant user who can call the server create API with scheduler hints, so the risk sits inside multi-tenant clouds rather than single-tenant setups. Operators who do not expose server create to untrusted users have lower exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nova","openstacknova"],"ptokens":["nova","openstack"],"labels":["cwe669","high","infrastructure","multitenant","nova","openstack","pypi","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':15A,23A '-46448':16A,24A 'bypass':7A 'claim':10A 'constraint':13A 'cve':14A,22A 'ghsa':18A 'ghsa-mfg3-p6m3-gjgr':17A 'gjgr':21A 'hint':5A 'inject':6A 'mfg3':19A 'nova':2A,3A,25A,26A,27A,29A,31A,33A 'openstack':1A,28A,30A,32A 'p6m3':20A 'placement':8A 'resourc':9A 'schedul':4A,12A","search_b":"'-669':35B 'aggreg':73B 'alloc':84B 'api':49B 'authent':58B 'avail':70B 'claim':64B 'comput':88B 'constraint':67B 'creat':48B 'cross':94B 'cross-ten':93B 'cwe':34B 'data':96B 'delet':101B 'devic':99B 'exhaust':87B 'hint':55B 'host':44B,72B 'imag':75B 'infrastructur':36B 'instanc':80B 'intern':53B 'leav':92B 'multi':38B 'multi-ten':37B 'node':89B 'nova':40B,45B 'nvme':98B 'openstack':41B 'placement':62B,83B 'resourc':63B,90B 'result':79B 'rule':77B 'schedul':54B,66B 'self':43B 'self-host':42B 'server':47B 'skip':61B 'strip':52B 'tenant':39B,95B 'trait':76B 'user':59B 'zone':71B","search_c":"'-2026':224C '-46448':225C '/993601':209C '/993602':204C '/993603':199C '/993604':194C '/epoxy':196C '/flamingo':201C '/gazpacho':206C '/hibiscus':211C '18.0.0':104C,186C '2025.1':195C '2025.2':200C '2026.1':205C '2026.2':210C '31.3.1':105C '32.0.0':106C '32.2.1':107C '33.0.0':108C '33.0.2':109C 'academi':119C,220C 'affect':102C,190C 'aggreg':151C 'alloc':162C 'api':128C 'authent':136C 'avail':148C 'bypass':139C 'chines':118C,219C 'claim':142C 'comput':116C,167C,217C 'constraint':145C 'creat':127C 'credit':212C 'cross':173C 'cross-ten':172C 'cve':223C 'data':175C 'delet':182C 'deploy':183C 'descript':110C 'devic':179C 'enforc':146C 'erichen':111C,213C 'exhaust':170C 'hint':134C 'host':150C 'imag':153C 'includ':147C 'instanc':158C,181C 'institut':114C,215C 'intern':132C 'later':188C 'lead':165C 'node':168C 'nova':103C,124C,185C 'nvme':178C 'patch':191C 'persist':176C 'placement':140C,161C 'report':122C 'resourc':141C,169C 'restrict':155C 'result':157C 'review.opendev.org':193C,198C,203C,208C 'review.opendev.org/993601':207C 'review.opendev.org/993602':202C 'review.opendev.org/993603':197C 'review.opendev.org/993604':192C 'run':184C 'schedul':133C,144C 'scienc':121C,222C 'server':126C 'strip':131C 'technolog':117C,218C 'tenant':174C 'trait':154C 'user':137C 'zone':149C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-06-16T20:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","cvss_by":"GitHub","poc_count":1,"sources":[{"source":"ghsa","external_id":"GHSA-mfg3-p6m3-gjgr","url":"https://github.com/advisories/GHSA-mfg3-p6m3-gjgr","severity":"medium","published_at":"2026-06-16T21:32:01+00:00","modified_at":"2026-11-13T00:31:25+00:00","first_seen_at":"2026-11-13T00:35:02+00:00","fetched_at":"2026-11-13T00:45:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-46448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46448","severity":null,"published_at":"2026-06-16T20:16:41+00:00","modified_at":"2026-11-13T00:20:17+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","fetched_at":"2026-11-13T00:41:07+00:00","note":null}],"documents":[{"id":140905,"url":"https://bugs.launchpad.net/nova/+bug/2151252","title":"Exploit: bugs.launchpad.net","kind":"poc","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"poc","confidence":null,"note":"Exploit: bugs.launchpad.net"},{"id":140906,"url":"https://www.openwall.com/lists/oss-security/2026/06/16/5","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"},{"id":140907,"url":"http://www.openwall.com/lists/oss-security/2026/06/16/5","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://bugs.launchpad.net/nova/+bug/2151252"},{"type":"epss","score":0.00272,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-46448"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}