---
id: CVE-2026-46448
aliases:
  - GHSA-mfg3-p6m3-gjgr
  - PYSEC-2026-2686
title: >-
  OpenStack Nova: Nova scheduler hint injection bypasses Placement resource
  claims and scheduling constraints
summary: >-
  OpenStack Nova: Nova scheduler hint injection bypasses Placement resource
  claims and scheduling constraints
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L'
vendor: nova
product: nova
ecosystem: pip
affected:
  - 'nova >= 18.0.0, <= 31.3.0'
  - 'nova >= 32.0.0, < 32.2.1'
  - 'nova >= 33.0.0, < 33.0.2'
patched:
  - nova 32.2.1
  - nova 33.0.2
published: '2026-06-16'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:51:09.100402114Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-mfg3-p6m3-gjgr'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46448'
  - url: 'https://bugs.launchpad.net/nova/+bug/2151252'
  - url: 'https://github.com/advisories/GHSA-mfg3-p6m3-gjgr'
  - url: 'https://github.com/openstack/nova'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2026-2686.yaml
  - url: 'https://pypi.org/project/nova'
  - url: 'https://review.opendev.org/993601'
  - url: 'https://review.opendev.org/993602'
  - url: 'https://review.opendev.org/993603'
  - url: 'https://review.opendev.org/993604'
  - url: 'https://www.openwall.com/lists/oss-security/2026/06/16/5'
  - url: 'http://www.openwall.com/lists/oss-security/2026/06/16/5'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00272
epssPercentile: 0.19796
cwe:
  - CWE-669
ingestedAt: '2026-06-29T14:31:47.480Z'
---

## Overview

## Affects

- Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2


## Description
Erichen from the Institute of Computing Technology, Chinese Academy of 
Sciences reported that Nova's server create API does not strip internal 
scheduler hints. An authenticated user can bypass Placement resource 
claims and scheduling constraint enforcement, including availability 
zone, host aggregate, and image trait restrictions. The resulting 
instance has no Placement allocation, which can lead to compute node 
resource exhaustion and cross-tenant data persistence on NVMe devices 
after instance deletion. Deployments running Nova 18.0.0 or later are 
affected.



## Patches

- https://review.opendev.org/993604 (2025.1/epoxy)
- https://review.opendev.org/993603 (2025.2/flamingo)
- https://review.opendev.org/993602 (2026.1/gazpacho)
- https://review.opendev.org/993601 (2026.2/hibiscus)


## Credits
- Erichen from Institute of Computing Technology, Chinese Academy of 
Sciences (CVE-2026-46448)

## Affected packages

- `nova >= 18.0.0, <= 31.3.0`
- `nova >= 32.0.0, < 32.2.1`
- `nova >= 33.0.0, < 33.0.2`

## Remediation

Upgrade to a patched release:

- `nova 32.2.1`
- `nova 33.0.2`