SB2026103089 - Ubuntu update for nova

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026103089

SB2026103089 - Ubuntu update for nova

Published: October 30, 2026

Security Bulletin ID SB2026103089
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Input validation error (CVE-ID: CVE-2026-46448)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass Placement resource claims and scheduling constraints.

The vulnerability exists due to improper input validation in the Nova server create API when processing user-supplied scheduler hints. A remote user can submit crafted scheduler hints to bypass Placement resource claims and scheduling constraints.

The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion.


Remediation

Install update from vendor's website.

References