CVE-2026-46448
Description
A flaw was found in OpenStack Nova. The server creation application programming interface (API) fails to remove specific hint data, leading to instances being created without proper Placement allocation. This can result in a denial of service, as resources may not be correctly assigned or managed for the affected instances.
Statement
Red Hat OpenStack Platform (RHOSP) 16.2, 17.1, and 18.0 ship affected versions of openstack-nova and are vulnerable to this flaw. The vulnerability requires authenticated access as a project member (the default 'member' role is sufficient to create servers). The Nova API is typically network-accessible within the OpenStack deployment. Exploitation requires no special configuration or admin privileges beyond standard project membership.
Mitigation
There is no configuration option to restrict which scheduler hint keys users can supply. However, operators can reduce the attack surface by:
1. Restricting access to the Nova API via network segmentation (firewall rules limiting which networks can reach the Nova API endpoint).
2. Using Keystone application credentials with limited scope to restrict which users can create servers.
These mitigations reduce exposure but do not fully prevent exploitation.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.5 | 8.5 | 5.4 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Changed | Changed | Unchanged |
| Confidentiality | None | None | Low |
| Integrity Impact | Low | Low | None |
| Availability Impact | High | High | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Red Hat CVSS v3 Score Explanation
Re-scored to align with NIST. S:U to S:C: hint injection crosses tenant boundaries (resource exhaustion on co-located tenants, bypass of AZ/host aggregate isolation). I:N to I:L: missing Placement allocations corrupt resource accounting state.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Unchecked input leads to cross-site scripting, process control, and SQL injection vulnerabilities, among others.
Acknowledgements
Upstream acknowledges Erichen (Institute of Computing Technology, Chinese Academy of Sciences) as the original reporter.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
