UNKNOWN OpenStack
CVE-2026-46448
OSSA-2026-022: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova’s server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance
Affected Products
- Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2
- CVE-2026-46448
References
- https://security.openstack.org/ossa/OSSA-2026-022.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-46448
This unknown severity vulnerability was published on 2026-06-16 via OpenStack. Affected: Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2, CVE-2026-46448.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.