What is the CVSS score of CVE-2026-46448?

CVE-2026-46448 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of OpenStack Nova are affected by CVE-2026-46448?

OpenStack Nova (compute service) contains a resource-accounting bypass that allows authenticated tenants to create instances that consume physical host resources without corresponding Placement…. A patch is available.

How to fix or mitigate CVE-2026-46448?

Within 24 hours: identify all OpenStack deployments, confirm Nova versions in use, and verify Placement service integration status. Within 7 days: deploy patch available per vendor security advisory to non-production Nova compute nodes and validate scheduler behavior. Within 30 days: apply patch to all production compute hosts, perform cross-tenant resource consumption audits, and validate Placement allocation consistency.

OpenStack Nova CVE-2026-46448

EUVD-2026-37218 HIGH

Incorrect Resource Transfer Between Spheres (CWE-669)

2026-06-16

GHSA-mfg3-p6m3-gjgr

Information Disclosure Nova Red Hat

8.5

CVSS 3.1 · NVD

Severity by source

Vendor (CNA) PRIMARY

MEDIUM

qualitative

NVD

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

vuln.today AI

8.5 HIGH

Network API reachable (AV:N) with low complexity, exploitable by an ordinary authenticated tenant (PR:L); broken cross-service resource accounting (S:C, I:L) enables host resource exhaustion (A:H) with no confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (CNA).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 26, 2026 - 15:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 26, 2026 - 15:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 26, 2026 - 15:52 vuln.today

cvss_changed

Severity Changed

Jun 26, 2026 - 15:52 NVD

MEDIUM HIGH

CVSS changed

Jun 26, 2026 - 15:52 NVD

5.4 (MEDIUM) 8.5 (HIGH)

Patch available

Jun 16, 2026 - 21:02 EUVD

CVSS changed

Jun 16, 2026 - 20:22 NVD

5.4 (MEDIUM)

Analysis Generated

Jun 16, 2026 - 16:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Resource-accounting bypass in OpenStack Nova (compute service) lets an authenticated tenant create an instance whose scheduler hint data is not properly stripped, resulting in a running VM that has no corresponding Placement allocation. Because the instance consumes real host CPU/RAM/disk that the Placement service never accounted for, an attacker with ordinary project credentials can quietly over-subscribe a compute host and degrade availability for co-located tenants. SSVC lists exploitation as proof-of-concept (no public exploit identified as weaponized) with partial technical impact; EPSS is low at 0.26% (17th percentile).

Technical ContextAI

OpenStack Nova is the compute orchestration service that provisions and manages virtual machine instances across a fleet of hypervisor hosts, relying on the Placement API as the authoritative inventory/accounting service that tracks which resources (vCPU, memory, disk) each instance reserves. The flaw is classified as CWE-669 (Incorrect Resource Transfer Between Spheres): the server-create API path fails to sanitize/strip certain scheduler 'hint' data, so the instance is built and boots on a host but the corresponding Placement allocation record is never created. The affected component per CPE is cpe:2.3:a:openstack:nova across all listed versions, and the defect lives in the API-to-scheduler-to-Placement handoff rather than in the hypervisor itself.

RemediationAI

Upgrade Nova to a fixed release on your branch: Vendor-released patch 33.0.2 for the 33.x line, 32.2.1 for the 32.x line, and 31.3.1 for the 18.0.0-31.x range. Consult the upstream advisory (https://seclists.org/oss-sec/2026/q2/943 and the openwall posting at https://www.openwall.com/lists/oss-security/2026/06/16/5) and the Launchpad bug (https://bugs.launchpad.net/nova/+bug/2151252) for the exact backport for your deployment. If immediate patching is not possible, reduce exposure by restricting which projects/roles may pass scheduler hints (tighten policy on the server-create API and any custom RBAC granting hint usage), and audit for instances that exist in Nova but have no matching Placement allocation using the 'nova-manage placement' / 'nova-audit' tooling and Placement allocation reports, reconciling or deleting orphaned instances - the trade-off is that audit-and-reconcile is detective rather than preventive and does not stop new occurrences until the patch is applied. Lowering host allocation_ratio headroom can blunt the availability impact of over-subscription but reduces legitimate capacity.