-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nova | pip | < 12.0.0a0 | 12.0.0a0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing context propagation in flavor retrieval during instance creation. The commit diff shows both v2 and v3 API handlers called 'get_flavor_by_flavor_id' without the 'ctxt=context' parameter, resulting in admin-level access checks instead of user-level. This allowed authenticated users to bypass 'is_public' restrictions by guessing flavor IDs. The added unit tests explicitly validate that private flavor access is now enforced, confirming the pre-patch vulnerability.