CVE-2026-46448: Openstack Nova

High severity, CVSS 8.5. EPSS: 0.5% chance of exploitation in the next 30 days.

In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.

Affected products

• Openstack Nova: from 18.0.0, before 31.3.1 (fixed in 31.3.1); from 32.0.0, before 32.2.1 (fixed in 32.2.1); from 33.0.0, before 33.0.2 (fixed in 33.0.2)

Published 2026-06-16. Last modified 2026-06-26.