Sign in
Deutsch English Español Polski
Medium

OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints

  • Disclosed: 16.06.2026
  • Updated: 11.10.2026 15:17

Affects

  • Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2

Description

Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected.

Patches

Credits

  • Erichen from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-46448)

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) nova >= 18.0.0, <= 31.3.0, >= 32.0.0, < 32.2.1, >= 33.0.0, < 33.0.2 32.2.1, 33.0.2

References

CVSS score 5.4/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Weakness (CWE)
CWE-669
Platform
Python (PyPI)
Package
nova
Disclosed
16.06.2026
Updated
11.10.2026 15:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-2686 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-mfg3-p6m3-gjgr - CC BY 4.0

Vulnerability history: nova

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (49) in the archive
Total entries
49
First → latest
08.2012 06.2026
Without a fix
5
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 11
  • Medium 29
  • Low 8

Disclosures per year

earlier: 7

Severity:
  1. OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints this entry
    Medium · 5.4 CVE-2026-46448 >= 18.0.0, <= 31.3.0, >= 32.0.0, < 32.2.1, >= 33.0.0, < 33.0.2 32.2.1, 33.0.2
  2. OpenStack Nova calls qemu-img without format restrictions for resize
    High · 8.2 CVE-2026-24708 >= 32.0.0.0rc1, <= 32.1.0, >= 31.0.0.0rc1, <= 31.2.0, <= 30.2.1 no fix
  3. OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption
    High · 7.5 CVE-2015-5162 < 12.0.4 12.0.4
  4. OpenStack Nova logs sensitive context from notification exceptions
    Critical · 9.8 CVE-2017-7214 >= 13.0.0, < 13.1.4, >= 14.0.0, < 14.0.5, >= 15.0.1, < 15.0.2 13.1.4, 14.0.5, 15.0.2
  5. OpenStack Nova Denial of service attack on the compute host
    High · 7.5 CVE-2017-18191 >= 15.0.0, < 15.1.1, >= 16.0.0, < 16.1.2 15.1.1, 16.1.2
  6. OpenStack Nova DoS by rebuilding the same instance with a new image multiple times
    High · 8.6 CVE-2017-17051 < 16.0.4 16.0.4
  7. An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously underg
    High · 8.3 CVE-2020-17376 < 19.3.1, >= 20.0.0, < 20.3.1, >= 21.0.0, < 21.1.0 19.3.1, 20.3.1, 21.1.0
  8. An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exceptio
    High · 6.5 CVE-2019-14433 >= 19.0.0, < 19.0.2, < 17.0.12, >= 18.0.0, < 18.2.2 19.0.2, 17.0.12, 18.2.2
  9. OpenStack Nova VMWare driver leaks rescued images
    High · 6.5 CVE-2014-2573 < 12.0.0a0 12.0.0a0
  10. OpenStack Nova Live migration can leak root disk into ephemeral storage
    High · 7.5 CVE-2013-7130 < 12.0.0a0 12.0.0a0
  11. OpenStack Compute Nova Unauthorised access to arbitrary VM using VNC token from deleted VM
    High · 6.5 CVE-2013-0335 < 12.0.0a0 12.0.0a0
  12. OpenStack Compute (Nova) Denial of service via a large number of calls to the addFixedIp function
    High · 6.5 CVE-2013-1838 < 12.0.0a0 12.0.0a0
  13. virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an ima
    High · 6.5 CVE-2012-3447 all versions no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.