CVE-2026-46448: OpenStack Nova Placement Vulnerability

CVE-2026-46448 Overview

CVE-2026-46448 affects OpenStack Nova versions before 33.0.2. The server create API fails to strip certain scheduler hint data submitted by authenticated users. As a result, the created instance is provisioned without a corresponding Placement service allocation. Placement tracks resource consumption across compute nodes, so a missing allocation undermines accurate capacity accounting.

The weakness is classified under CWE-669: Incorrect Resource Transfer Between Spheres. Exploitation requires only low-privilege API access over the network and no user interaction.

Critical Impact
Authenticated tenants can provision Nova instances that bypass Placement accounting, breaking quota enforcement and resource scheduling integrity in multi-tenant OpenStack clouds.

Affected Products

OpenStack Nova versions prior to 33.0.2
OpenStack deployments exposing the Nova Compute API to tenant users
Multi-tenant clouds relying on the Placement service for quota and scheduling

Discovery Timeline

2026-06-16 - CVE-2026-46448 published to NVD
2026-06-16 - Coordinated disclosure on the Openwall oss-security mailing list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46448

Vulnerability Analysis

The Nova POST /servers API accepts scheduler hints that influence instance placement decisions. Before version 33.0.2, the API does not sanitize specific hint fields before passing them through the build workflow. The compute manager proceeds to create the instance, but the path taken skips the Placement allocation step that normally reserves CPU, memory, and disk inventory on the selected host.

The resulting virtual machine runs on a hypervisor while Placement believes the underlying resources remain free. Subsequent scheduling decisions may then overcommit the host, because the scheduler queries Placement to determine capacity. Quota systems that reconcile against Placement allocations also lose accuracy.

The defect maps to CWE-669, where data crosses a control boundary without proper validation. According to the Launchpad bug report #2151252, the fix updates the API layer to strip or reject the offending hint structure before it reaches the conductor.

Root Cause

Nova's server create handler trusts a subset of hint keys submitted by the API client and forwards them into the build request. The code path neither strips nor validates these keys against the expected schema. When the hint shape causes the conductor to short-circuit normal scheduling, the Placement allocation call is never issued.

Attack Vector

An authenticated tenant with permission to create instances sends a crafted POST /servers request that includes the unsanitized hint. The Nova API accepts the request and provisions an instance without Placement allocation. The attacker gains a running workload that does not count against tracked inventory. Repeated use can exhaust hypervisor resources while quota and scheduling subsystems report capacity as available. See the Openwall OSS Security discussion for the disclosure thread.

Detection Methods for CVE-2026-46448

Indicators of Compromise

Nova instances in ACTIVE state with no matching consumer record in the Placement service allocations table
Discrepancy between hypervisor vcpus_used or memory_mb_used reported by nova hypervisor-show and the resource provider usage reported by Placement
API access logs containing POST /servers requests with unusual or malformed os:scheduler_hints payloads
Tenant resource usage that exceeds enforced quotas without quota events

Detection Strategies

Run a reconciliation job that joins Nova instance UUIDs against Placement consumers and flags instances missing allocations
Parse nova-api access logs for scheduler_hints keys outside the documented set in the Nova API reference
Alert on hypervisor pressure metrics (CPU, memory, disk) that diverge from Placement-reported usage
Correlate instance creation events with subsequent Placement PUT /allocations/{consumer} calls and flag missing pairs

Monitoring Recommendations

Forward nova-api, nova-conductor, and placement-api logs to a centralized log platform with structured parsing
Track per-tenant instance creation rates and compare against Placement allocation creation rates
Schedule periodic audits using openstack resource provider usage show against openstack hypervisor stats show

How to Mitigate CVE-2026-46448

Immediate Actions Required

Upgrade Nova to version 33.0.2 or later across all control plane nodes running nova-api and nova-conductor
Restart nova-api and nova-conductor services after package installation to load patched code
Audit existing instances for missing Placement allocations and remediate before further scheduling decisions are made
Restrict the os_compute_api:servers:create:forced_host and related scheduler hint policies to trusted roles in policy.yaml

Patch Information

The fix is included in OpenStack Nova 33.0.2. Refer to the Launchpad bug report #2151252 for commit references and backport status to supported stable branches. Operators on older OpenStack releases should consult their distribution's security advisories for backported packages.

Workarounds

Tighten Nova RBAC policies to deny scheduler hint usage for untrusted projects until the patch is deployed
Use an API gateway or middleware to strip unknown keys from the os:scheduler_hints body of POST /servers requests
Run frequent reconciliation between Nova instances and Placement allocations and quarantine orphaned instances

bash

# Audit instances for missing Placement allocations
for uuid in $(openstack server list --all-projects -f value -c ID); do
  if ! openstack resource provider allocation show "$uuid" \
      -f value > /dev/null 2>&1; then
    echo "Instance $uuid has no Placement allocation"
  fi
done