What is CVE-2026-46448?

CVE-2026-46448 is a medium-severity vulnerability in Openstack Nova, classified under Incorrect Resource Transfer Between Spheres. CVSS score: 5.4/10. Published 2026-06-16.

How severe is CVE-2026-46448?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Vulnerability in Openstack Nova

CVE-2026-46448

In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L.

Affected products

Openstack Nova — versions 18.0.0, 32.0.0, 33.0.0

Weakness classification (CWE)

CWE-669 — Incorrect Resource Transfer Between Spheres

References

cve@mitre.org
cve@mitre.org
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2026-46448?: CVE-2026-46448 is a medium-severity vulnerability in Openstack Nova, classified under Incorrect Resource Transfer Between Spheres. CVSS score: 5.4/10. Published 2026-06-16.
How severe is CVE-2026-46448?: Medium severity. CVSS v3 base score is 5.4 out of 10.