PYSEC-2026-2686

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/nova/PYSEC-2026-2686.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-2686
Aliases
Published
2026-07-13T15:46:18.433999Z
Modified
2026-07-13T16:32:17.576795152Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
Summary
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
Details

Affects

  • Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2

Description

Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected.

Patches

  • https://review.opendev.org/993604 (2025.1/epoxy)
  • https://review.opendev.org/993603 (2025.2/flamingo)
  • https://review.opendev.org/993602 (2026.1/gazpacho)
  • https://review.opendev.org/993601 (2026.2/hibiscus)

Credits

  • Erichen from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-46448)
References

Affected packages

PyPI / nova

Package

Name
nova
View open source insights on deps.dev
Purl
pkg:pypi/nova

Affected ranges

Type
ECOSYSTEM
Events
Introduced
18.0.0
Fixed
31.3.1
Introduced
32.0.0
Fixed
32.2.1
Introduced
33.0.0
Fixed
33.0.2

Affected versions

18.*
18.0.2
18.0.3
18.1.0
18.2.0
18.2.1
18.2.2
18.2.3
18.3.0
19.*
19.0.0.0rc1
19.0.0.0rc2
19.0.0
19.0.1
19.0.2
19.0.3
19.1.0
19.2.0
19.3.0
19.3.1
19.3.2
20.*
20.0.0.0rc1
20.0.0.0rc2
20.0.0
20.0.1
20.1.0
20.1.1
20.2.0
20.3.0
20.4.0
20.4.1
20.5.0
20.6.0
20.6.1
21.*
21.0.0.0rc1
21.0.0.0rc2
21.0.0
21.1.0
21.1.1
21.1.2
21.2.0
21.2.1
21.2.2
21.2.3
21.2.4
22.*
22.0.0.0rc1
22.0.0
22.0.1
22.1.0
22.2.0
22.2.1
22.2.2
22.3.0
22.4.0
23.*
23.0.0.0rc1
23.0.0.0rc2
23.0.0
23.0.1
23.0.2
23.1.0
23.2.0
23.2.1
23.2.2
24.*
24.0.0.0rc1
24.0.0.0rc2
24.0.0
24.1.0
24.1.1
24.2.0
24.2.1
25.*
25.0.0.0rc1
25.0.0
25.0.1
25.1.0
25.1.1
25.2.0
25.2.1
25.3.0
26.*
26.0.0.0rc1
26.0.0.0rc2
26.0.0
26.1.0
26.1.1
26.2.0
26.2.1
26.2.2
26.3.0
27.*
27.0.0.0rc1
27.0.0
27.1.0
27.2.0
27.3.0
27.4.0
27.5.0
27.5.1
28.*
28.0.0.0rc1
28.0.0
28.0.1
28.1.0
28.2.0
28.3.0
28.3.1
29.*
29.0.0.0rc1
29.0.0
29.0.1
29.0.2
29.1.0
29.2.0
29.2.1
29.2.2
29.3.0
29.4.0
30.*
30.0.0.0rc1
30.0.0
30.1.0
30.2.0
30.2.1
30.3.0
31.*
31.0.0.0rc1
31.0.0
31.0.1
31.1.0
31.2.0
31.3.0
32.*
32.0.0
32.1.0
32.2.0
33.*
33.0.0
33.0.1

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/nova/PYSEC-2026-2686.yaml"