CVE-2026-46448

EUVD-2026-37218
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
openstacknova
18.0.0 ≤
𝑥
< 31.3.1
CNA
openstacknova
32.0.0 ≤
𝑥
< 32.2.1
CNA
openstacknova
33.0.0 ≤
𝑥
< 33.0.2
CNA
Debian logo
Debian Releases
Debian Product
Codename
nova
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Common Weakness Enumeration
References
https://bugs.launchpad.net/nova/+bug/2151252
https://www.openwall.com/lists/oss-security/2026/06/16/5
http://www.openwall.com/lists/oss-security/2026/06/16/5