CVE-2026-46448

In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.

Score

CVSS 3.1 8.5 High

Status

Analyzed - cve@mitre.org

Published

2026-06-16

Last modified

2026-10-25

Weaknesses

CWE-669

Affected products

• Nova (Openstack)

References

• https://bugs.launchpad.net/nova/+bug/2151252
• https://www.openwall.com/lists/oss-security/2026/06/16/5
• http://www.openwall.com/lists/oss-security/2026/06/16/5