Nova

CVE-2026-46448 Jun 16, 15:19 PyPI HIGH PATCH GHSA This Week

Resource-accounting bypass in OpenStack Nova (compute service) lets an authenticated tenant create an instance whose scheduler hint data is not properly stripped, resulting in a running VM that has no corresponding Placement allocation. Because the instance consumes real host CPU/RAM/disk that the Placement service never accounted for, an attacker with ordinary project credentials can quietly over-subscribe a compute host and degrade availability for co-located tenants. SSVC lists exploitation as proof-of-concept (no public exploit identified as weaponized) with partial technical impact; EPSS is low at 0.26% (17th percentile).

CVE-2024-40767 Jul 24, 05:15 PyPI MEDIUM POC This Month

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-32498 Jul 05, 02:15 PyPI MEDIUM PATCH This Month

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-48795 Dec 18, 16:15 LIB MEDIUM POC PATCH THREAT This Month

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.

CVE-2022-37394 Aug 03, 07:15 PyPI LOW POC PATCH Monitor

An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. Public exploit code available.

CVE-2020-17376 Aug 26, 19:15 PyPI HIGH POC PATCH This Week

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2019-14433 Aug 09, 19:15 PyPI MEDIUM PATCH This Month

An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2017-17051 Dec 05, 18:29 PyPI HIGH PATCH This Week

An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

CVE-2017-16239 Nov 14, 17:29 PyPI MEDIUM PATCH This Month

In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2017-7214 Mar 21, 18:59 PyPI CRITICAL PATCH Act Now

An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2015-5162 Oct 07, 14:59 PyPI HIGH POC PATCH This Week

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2016-2140 Apr 12, 14:59 PyPI MEDIUM PATCH This Month

The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2015-8749 Jan 15, 19:59 PyPI MEDIUM PATCH This Month

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2015-7548 Jan 12, 19:59 LOW Monitor

OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instances and use_cow_images is set to false, allow remote authenticated users to read. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2015-7713 Oct 29, 20:59 PyPI MEDIUM PATCH This Month

OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2015-3280 Oct 26, 17:59 PyPI MEDIUM PATCH This Month

OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2015-3241 Sep 08, 15:59 PyPI MEDIUM PATCH This Month

OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, which allows remote authenticated users to cause a denial of. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2015-0259 Apr 01, 14:59 PyPI MEDIUM PATCH This Month

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable.

CVE-2014-8333 Oct 31, 14:55 PyPI MEDIUM PATCH This Month

The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resize state. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2014-3708 Oct 31, 14:55 PyPI MEDIUM POC PATCH This Month

OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an IP filter in a list active servers API. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2014-8750 Oct 15, 14:55 MEDIUM This Month

Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2014-7231 Oct 08, 19:55 PyPI LOW POC PATCH Monitor

The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands,. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. Public exploit code available.

CVE-2014-7230 Oct 08, 19:55 LOW Monitor

The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.

CVE-2014-3608 Oct 06, 14:55 PyPI LOW POC PATCH Monitor

The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into. Rated low severity (CVSS 2.7), this vulnerability is low attack complexity. Public exploit code available.

CVE-2014-3517 Aug 07, 11:13 PyPI MEDIUM PATCH This Month

api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2013-6437 Mar 06, 15:55 PyPI MEDIUM PATCH This Month

The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a denial of service (disk consumption) by creating and. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.

CVE-2013-7048 Jan 23, 21:55 PyPI LOW POC PATCH Monitor

OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local. Rated low severity (CVSS 3.3). Public exploit code available.

CVE-2013-2256 Sep 16, 19:14 PyPI MEDIUM POC PATCH This Month

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available.

CVE-2012-3447 Aug 20, 18:55 PyPI MEDIUM POC PATCH This Month

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable. Public exploit code available.

CVE-2012-1585 Aug 17, 00:55 PyPI MEDIUM POC PATCH This Month

OpenStack Compute (Nova) Essex before 2011.3 allows remote authenticated users to cause a denial of service (Nova-API log file and disk consumption) via a long server name. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2012-2101 Jun 07, 19:55 PyPI LOW PATCH Monitor

Openstack Compute (Nova) Folsom, 2012.1, and 2011.3 does not limit the number of security group rules, which allows remote authenticated users with certain permissions to cause a denial of service. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.

CVE-2012-0030 Jan 13, 18:55 MEDIUM PATCH This Month

Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified project_id URI. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable.