5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46448

CVE-2026-46448: OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints

In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46448

CVE-2026-46448:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nova	pip	>= 18.0.0, <= 31.3.0
nova	pip	>= 32.0.0, < 32.2.1	32.2.1
nova	pip	>= 33.0.0, <= 33.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the server creation workflow of OpenStack Nova, where the API layer fails to sanitize user-provided scheduler hints. The analysis of the bug report and the corresponding patch pinpoints the create method within the nova.compute.api.API class as the vulnerable function. This function directly receives the scheduler_hints dictionary from the user's API request. The vulnerability is triggered when a malicious hint, such as {"_nova_check_type": "rebuild"}, is included in the request. This hint is intended for internal use but was not being filtered. The scheduler logic later inspects this hint and incorrectly treats the server creation request as a rebuild operation, which bypasses critical placement and resource allocation checks. The provided patch directly modifies the create function to add a filtering step that removes any scheduler hints prefixed with _nova, thus closing the security hole at the point of entry.

Vulnerable functions

API.create

nova/compute/api.py

The `create` function in `nova.compute.api.API` is the entry point for server creation requests. It accepts `scheduler_hints` from the user. Before the patch, this function did not sanitize these hints, allowing an attacker to inject internal hints prefixed with `_nova`. Specifically, by passing `_nova_check_type: rebuild`, an attacker could trick the scheduler into bypassing resource and placement validation, leading to resource exhaustion. The patch mitigates this by stripping out any hints prefixed with `_nova` before they are processed further.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.