OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
Affects
- Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2
Description
Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected.
Patches
- https://review.opendev.org/993604 (2025.1/epoxy)
- https://review.opendev.org/993603 (2025.2/flamingo)
- https://review.opendev.org/993602 (2026.1/gazpacho)
- https://review.opendev.org/993601 (2026.2/hibiscus)
Credits
- Erichen from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-46448)
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | nova | >= 18.0.0, <= 31.3.0, >= 32.0.0, < 32.2.1, >= 33.0.0, < 33.0.2 | 32.2.1, 33.0.2 |
Referencias
- https://nvd.nist.gov/vuln/detail/CVE-2026-46448
- https://bugs.launchpad.net/nova/+bug/2151252
- https://github.com/openstack/nova
- https://review.opendev.org/993601
- https://review.opendev.org/993602
- https://review.opendev.org/993603
- https://review.opendev.org/993604
- https://www.openwall.com/lists/oss-security/2026/06/16/5
- http://www.openwall.com/lists/oss-security/2026/06/16/5
- https://pypi.org/project/nova
- https://github.com/advisories/GHSA-mfg3-p6m3-gjgr
- https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2026-2686.yaml
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L- Debilidad (CWE)
CWE-669- Plataforma
- Python (PyPI)
- Paquete
nova- Publicada
- 16.06.2026
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-2686 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-mfg3-p6m3-gjgr - CC BY 4.0
Historial de vulnerabilidades: nova
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 49
- Primera → última
- 08.2012 06.2026
- Sin corrección
- 5
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 11
- Media 29
- Baja 8
Divulgaciones por año
- 2017: 1
- 2018: 0
- 2019: 1
- 2020: 1
- 2021: 0
- 2022: 34
- 2023: 1
- 2024: 2
- 2025: 0
- 2026: 2
antes: 7
-
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.