CVE-2026-46448: [OSSA-2026-022] OpenStack Nova: Nova scheduler hint injection bypasses Placement source claims and scheduling constraints (CVE-2026-46448)
Affects
- Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2
Description Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected.
Patches
- https://review.opendev.org/993604 (2025.1/epoxy) - https://review.opendev.org/993603 (2025.2/flamingo) - https://review.opendev.org/993602 (2026.1/gazpacho) - https://review.opendev.org/993601 (2026.2/hibiscus)
Credits - Erichen from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-46448)
Other sources
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/novato a version that resolves this vulnerability.Fixed in 32.2.1 - Upgrade
Upgrade
OpenStack Novato a version that resolves this vulnerability.Fixed in 31.3.1 - Upgrade
Upgrade
OpenStack Novato a version that resolves this vulnerability.Fixed in 32.2.1 - Upgrade
Upgrade
OpenStack Novato a version that resolves this vulnerability.Fixed in 33.0.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch OSSA-2026-022 - Compensating control
As an interim mitigation before patching, restrict access to the Nova server create API so only authorized users can create servers (reduce the ability for an authenticated user to bypass Placement resource claims and scheduling constraints).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46448?
The severity of CVE-2026-46448 is medium with a score of 5.4.
What systems are affected by CVE-2026-46448?
CVE-2026-46448 affects Nova versions >=18.0.0 and <31.3.1, >=32.0.0 and <32.2.1, and >=33.0.0 and <33.0.2.
How do I fix CVE-2026-46448?
To mitigate CVE-2026-46448, upgrade Nova to versions 31.3.1, 32.2.1, or 33.0.2 or later.
What is the impact of CVE-2026-46448?
CVE-2026-46448 allows an authenticated user to bypass Placement resource claims and scheduling constraints due to unstripped internal scheduler hints.
Who reported CVE-2026-46448?
CVE-2026-46448 was reported by Erichen from the Institute of Computing Technology, Chinese Academy of Sciences.