Server Creation API Vulnerability in OpenStack Nova
CVE-2026-46448

5.4MEDIUM

Key Information:

Vendor

Openstack
Status
Nova
Vendor
CVE Published:
16 June 2026

What is CVE-2026-46448?

In OpenStack Nova prior to version 33.0.2, a vulnerability exists within the server creation API. This flaw allows for certain hint data to remain unstripped, leading to instances being created without proper allocation in Placement. This oversight can impact resource management and performance, making it essential for users and administrators to apply updates or workarounds promptly to mitigate potential issues.

Affected Version(s)

Nova 18.0.0 < 31.3.1

Nova 32.0.0 < 32.2.1

Nova 33.0.0 < 33.0.2

References

https://bugs.launchpad.net/nova/+bug/2151252
https://www.openwall.com/lists/oss-security/2026/06/16/5

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.