In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data.
Priority HIGH 70CWE-669Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Partial Red Hat: 1 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00272 19th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Nova (OpenStack): 31.3.1, 32.2.1, 33.0.2nova (PyPI): 32.2.1, 33.0.2Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenStack | Nova | 18.0.0 to before 31.3.1; 32.0.0 to before 32.2.1; 33.0.0 to before 33.0.2 | 31.3.1, 32.2.1, 33.0.2 | Patch available | CNA |
| — | nova (PyPI) | 18.0.0 – 31.3.0 | — | No fix listed | GHSA-mfg3-p6m3-gjgr |
| — | nova (PyPI) | 32.0.0 to before 32.2.1 | 32.2.1 | Patch available | GHSA-mfg3-p6m3-gjgr |
| — | nova (PyPI) | 33.0.0 to before 33.0.2 | 33.0.2 | Patch available | GHSA-mfg3-p6m3-gjgr |
- Nova VendorOpenStack Affected 18.0.0 to before 31.3.1; 32.0.0 to before 32.2.1; 33.0.0 to before 33.0.2 Fixed in 31.3.1, 32.2.1, 33.0.2 Patch available CNA
- nova (PyPI) Vendor— Affected 18.0.0 – 31.3.0 Fixed in — No fix listed GHSA-mfg3-p6m3-gjgr
- nova (PyPI) Vendor— Affected 32.0.0 to before 32.2.1 Fixed in 32.2.1 Patch available GHSA-mfg3-p6m3-gjgr
- nova (PyPI) Vendor— Affected 33.0.0 to before 33.0.2 Fixed in 33.0.2 Patch available GHSA-mfg3-p6m3-gjgr
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* | 18.0.0 to before 31.3.1; 32.0.0 to before 32.2.1; 33.0.0 to before 33.0.2 | Vulnerable | OpenStack |
- cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* Versions 18.0.0 to before 31.3.1; 32.0.0 to before 32.2.1; 33.0.0 to before 33.0.2 Vulnerable ·OpenStack
Remediation
- Fix · CNA Nova (OpenStack) Fixed in 31.3.1, 32.2.1, 33.0.2
- Fix · GHSA-mfg3-p6m3-gjgr nova (PyPI) Fixed in 32.2.1 Advisory →
- Fix · GHSA-mfg3-p6m3-gjgr nova (PyPI) Fixed in 33.0.2 Advisory →
Red Hat 1 advisory
- RHSA-2026:94039 Released 2026-11-02 · Red Hat rating ImportantRed Hat OpenStack Platform 13.0 security advisory
- Red Hat OpenStack Platform 13.0 - ELS openstack-keystone-1:13.0.4-10.el7ost, openstack-nova-1:17.0.13-43.el7ost, openstack-nova-api-1:17.0.13-43.el7ost +16
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| Red Hat OpenStack Platform 13.0 - ELS | Fixed | RHSA-2026:94039 |
Not affected: 1 product
- Red Hat OpenStack Platform 13.0 - ELS
Timeline
- 2026-10-02 Threatist record created from CVE-2026-46448
- 2026-10-03 Alias added: GHSA-mfg3-p6m3-gjgr
- 2026-11-03 Fix available: RHSA-2026:94039 · Red Hat
- 2026-11-03 Fix available: Red Hat OpenStack Platform 13.0 - ELS · Red Hat
References
Advisory 4
More OpenStack Nova vulnerabilities
- TI-2022-23762 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and… CVSS 3.1MEDIUM 5.7
- TI-2021-02596 Open redirect in openstack-nova CVSS 3.1MEDIUM 6.1
- TI-2017-04900 An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3… CVSS 3.0CRITICAL 9.8
- TI-2017-12516 An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. CVSS 3.0HIGH 8.6
- TI-2020-13145 An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova… CVSS 3.1HIGH 8.3
- TI-2017-13376 An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. CVSS 3.0HIGH 7.5
Sources
- CVE-2026-46448 · CVE Program
- CVE-2026-46448 · NVD
- FIRST EPSS
- GHSA-mfg3-p6m3-gjgr · GitHub Advisory Database · CC BY 4.0
- CVE-2026-46448 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences