PYSEC-2026-692 OpenStack Nova DoS by rebuilding the same instance with a new image multiple times

An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was...

PYSEC-2026-694 OpenStack Nova Filter Scheduler Bypass

In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters for example, the ImagePropertiesFilter or the IsolatedHostsFilter. All setups using Nova Filter...

OpenStack Nova DoS by rebuilding the same instance with a new image multiple times

An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was...

OpenStack Nova Denial of service attack on the compute host

An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. The same code error...

PYSEC-2026-689 OpenStack Nova Denial of service attack on the compute host

An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. The same code error...

OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor

OpenStack Nova before 2012.1 allows someone with access to an EC2ACCESSKEY equivalent to a username to obtain the EC2SECRETKEY equivalent to a password. Exposing the EC2ACCESSKEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2SECRETKEY. A...

PYSEC-2026-691 OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor

OpenStack Nova before 2012.1 allows someone with access to an EC2ACCESSKEY equivalent to a username to obtain the EC2SECRETKEY equivalent to a password. Exposing the EC2ACCESSKEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2SECRETKEY. A...

Openstack nova qcow format could expose host filesystem information

Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem...

PYSEC-2026-690 Openstack nova qcow format could expose host filesystem information

Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem...

PYSEC-2026-693 Open Redirect in CPython that affects users of OpenStack Nova

A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL...

Open Redirect in CPython that affects users of OpenStack Nova

A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL...

controlled-execution-system (>=0.1.25, <=0.1.31), wandelbots-nova (>=5.1.2, <=5.7.4) potentially affected by CVE-2026-47103 via python-statemachine (>=3.0.0, <=3.1.2)

python-statemachine PYPI version =3.0.0, =0.1.25, =5.1.2, =5.7.4 Source cves: CVE-2026-47103 Source advisory: OSV:PYSEC-2026-506...

aiowhitebit-mcp (>=0.2.2, <=0.2.4), antdigital-aico-guard-mcp-server (>=0.1.0, <=0.1.3) +4 more potentially affected by CVE-2026-32871 via fastmcp (2.2.5)

fastmcp PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aiowhitebit-mcp =0.2.2, =0.1.0, =0.2.1, =3.2.2 - spoon-ai-sdk 0.1.3 - spoon-toolkits 0.1.3 Source cves: CVE-2026-32871 Source advisory:...

PYSEC-2026-432 OpenStack Nova logs sensitive context from notification exceptions

An issue was discovered in exceptionwrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens...

OpenStack Nova logs sensitive context from notification exceptions

An issue was discovered in exceptionwrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens...

PT-2026-53514

An issue was discovered in exception wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens...

controlled-execution-system (>=0.1.25, <=0.1.31), wandelbots-nova (>=5.1.2, <=5.7.4) potentially affected by CVE-2026-47103 via python-statemachine (>=3.0.0, <=3.1.2)

python-statemachine PYPI version =3.0.0, =0.1.25, =5.1.2, =5.7.4 Source cves: CVE-2026-47103 Source advisory: SNYK:PYTHON-PYTHONSTATEMACHINE-17675195...

controlled-execution-system (>=0.1.25, <=0.1.31), wandelbots-nova (>=5.1.2, <=5.7.4) potentially affected by CVE-2026-47103 via python-statemachine (>=3.0.0, <=3.1.2)

python-statemachine PYPI version =3.0.0, =0.1.25, =5.1.2, =5.7.4 Source cves: CVE-2026-47103 Source advisory: OSV:GHSA-V4JC-PM6R-3VJ8...

controlled-execution-system (>=0.1.25, <=0.1.31), wandelbots-nova (>=5.1.2, <=5.7.4) potentially affected by CVE-2026-47103 via python-statemachine (>=3.0.0, <=3.1.2)

python-statemachine PYPI version =3.0.0, =0.1.25, =5.1.2, =5.7.4 Source cves: CVE-2026-47103 Source advisory: GHSA-V4JC-PM6R-3VJ8...

CVE-2026-46448

A flaw was found in OpenStack Nova. The server creation application programming interface API fails to remove specific hint data, leading to instances being created without proper Placement allocation. This can result in a denial of service, as resources may not be correctly assigned or managed f...