CVE-2026-46448
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
- CVSS 3.1
- 8.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-25)
- CWE
- CWE-669
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openstack:nova
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mfg3-p6m3-gjgr | PyPI | nova | >=18.0.0 <=31.3.0 | no fix published |
| GHSA-mfg3-p6m3-gjgr | PyPI | nova | >=32.0.0 <32.2.1 | 32.2.1 |
| GHSA-mfg3-p6m3-gjgr | PyPI | nova | >=33.0.0 <33.0.2 | 33.0.2 |
| PYSEC-2026-2686 | PyPI | nova | >=18.0.0 <31.3.1 >=32.0.0 <32.2.1 >=33.0.0 <33.0.2 | 31.3.1, 32.2.1, 33.0.2 |