Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the server creation workflow of OpenStack Nova, where the API layer fails to sanitize user-provided scheduler hints. The analysis of the bug report and the corresponding patch pinpoints the create method within the nova.compute.api.API class as the vulnerable function. This function directly receives the scheduler_hints dictionary from the user's API request. The vulnerability is triggered when a malicious hint, such as {"_nova_check_type": "rebuild"}, is included in the request. This hint is intended for internal use but was not being filtered. The scheduler logic later inspects this hint and incorrectly treats the server creation request as a rebuild operation, which bypasses critical placement and resource allocation checks. The provided patch directly modifies the create function to add a filtering step that removes any scheduler hints prefixed with _nova, thus closing the security hole at the point of entry.
API.createnova/compute/api.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nova | pip | >= 18.0.0, <= 31.3.0 | |
| nova | pip | >= 32.0.0, < 32.2.1 | 32.2.1 |
| nova | pip | >= 33.0.0, <= 33.0.1 | 33.0.2 |