5.4Medium
CVE-2026-46448
Description
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
Weakness (CWE):
CWE-669
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
References and patches
- https://bugs.launchpad.net/nova/+bug/2151252 ExploitIssue TrackingThird Party Advisory
- https://www.openwall.com/lists/oss-security/2026/06/16/5 Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/06/16/5 Mailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2026/11/msg00026.html
CPE matches (NVD) (3)
cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*≥ 18.0.0 < 31.3.1cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*≥ 32.0.0 < 32.2.1cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*≥ 33.0.0 < 33.0.2