Skip to content
Log inStart free trial

GHSA-mfg3-p6m3-gjgr CVE-2026-46448 PYSEC-2026-2686

OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints

High PyPI
Severity
5.4 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.27%
Chance of exploitation in the next 30 days. Higher than 19.58% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-669 Incorrect Resource Transfer Between Spheres
Fix
32.2.1
Upgrade nova to this version or later

Description

Affects

  • Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2

Description

Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected.

Patches

Credits

  • Erichen from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-46448)

Affected versions

PyPI

PackageVulnerableFixed in
nova
>= 18.0.0, <= 31.3.0
 No fix yet
nova
>= 32.0.0, < 32.2.1
32.2.1
nova
>= 33.0.0, < 33.0.2
33.0.2
nova
>= 18.0.0, < 31.3.1
>= 32.0.0, < 32.2.1
>= 33.0.0, < 33.0.2
31.3.1
32.2.1
33.0.2

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

nova PyPI → 32.2.1

pip
pip install --upgrade "nova>=32.2.1"
poetry
poetry add "nova>=32.2.1"
uv
uv add "nova>=32.2.1"

Severity breakdown

CVSS 3.1 5.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Weakness

CWE-669: Incorrect Resource Transfer Between Spheres

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-m4f3-qp2w-gwh6
OpenStack Nova calls qemu-img without format restrictions for resize
High Also affects nova
GHSA-rm86-h44c-2r2m
OpenStack Nova vulnerable to unauthorized access to potentially sensitive data
Medium Also affects nova
GHSA-r4v4-w9pv-6fph
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
Medium Also affects nova
GHSA-7h75-hwxx-qpgc
OpenStack Cinder, glance, and Nova vulnerable to Path Traversal
Medium Also affects nova
GHSA-v725-c588-h936
OpenStack Nova Changing vnic_type breaks compute service restart
Low Also affects nova
GHSA-22jm-4hxw-35jf
OpenStack Nova can leak consoleauth token into log files
Low Also affects nova
GHSA-43cm-73px-5v4m
OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors
Low Also affects nova
GHSA-j6xh-q826-55jw
OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack
Medium Also affects nova
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor