# nova (PyPI) vulnerabilities 54 known vulnerabilities (2 high, 5 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Weekly downloads: 1,487 - Dependents: 1 - Registry: https://pypi.org/project/nova/ ## Advisories (54) ### [CVE-2026-46448](https://cve.now/CVE-2026-46448): In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. - Severity: Medium 5.4 - Published: Jun 16, 2026 - Affected: from 18.0.0, fixed in 31.3.1; from 32.0.0, fixed in 32.2.1; from 33.0.0, fixed in 33.0.2; from 18.0.0, through 31.3.0; from 32.0.0, fixed in 32.2.1; from 33.0.0, fixed in 33.0.2. ### [CVE-2026-24708](https://cve.now/CVE-2026-24708): An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. - Severity: High 8.2 - Published: Feb 18, 2026 - Affected: from 32.0.0.0rc1, through 32.1.0; from 31.0.0.0rc1, through 31.2.0; through 30.2.1; through 30.2.1; from 31.0.0.0rc1, through 31.2.0; from 32.0.0.0rc1, through 32.1.0. ### [CVE-2024-40767](https://cve.now/CVE-2024-40767): In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2… - Severity: Medium 6.5 - Published: Jul 24, 2024 - Affected: through 27.4.0; from 28.0.0, through 28.2.0; from 29.0.0, through 29.1.0; through 27.4.0; from 28.0.0, through 28.2.0; from 29.0.0, through 29.1.0. ### [CVE-2024-32498](https://cve.now/CVE-2024-32498): An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. - Severity: Medium 6.5 - Published: Jul 5, 2024 - Affected: through 29.0.2. ### [CVE-2022-47951](https://cve.now/CVE-2022-47951): An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and… - Severity: Medium 5.7 - Published: Jan 26, 2023 - Affected: fixed in 24.1.2; from 25.0.0, fixed in 25.0.2; fixed in 24.1.2; from 25.0.0, fixed in 25.0.2. ### [CVE-2022-37394](https://cve.now/CVE-2022-37394): An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. - Severity: Unrated - Published: Aug 3, 2022 - Affected: fixed in 23.2.2; from 24.0.0, fixed in 24.1.2; from 25.0.0, fixed in 25.0.2; fixed in 23.2.2; from 24.0.0, fixed in 24.1.2; from 25.0.0, fixed in 25.0.2. ### [CVE-2021-3654](https://cve.now/CVE-2021-3654): A vulnerability was found in openstack-nova's console proxy, noVNC. - Severity: Unrated - Published: Mar 2, 2022 - Affected: fixed in 21.2.3; from 22.0.0, fixed in 22.2.3; from 23.0.0, fixed in 23.0.3; fixed in 21.2.3; from 22.0.0, fixed in 22.2.3; from 23.0.0, fixed in 23.0.3. ### [CVE-2020-17376](https://cve.now/CVE-2020-17376): An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. - Severity: Unrated - Published: Aug 26, 2020 - Affected: fixed in 19.3.1; from 20.0.0, fixed in 20.3.1; versions 21.0.0; fixed in 19.3.1; from 20.0.0, fixed in 20.3.1; from 21.0.0, fixed in 21.1.0. ### [CVE-2015-9543](https://cve.now/CVE-2015-9543): An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. - Severity: Unrated - Published: Feb 19, 2020 - Affected: fixed in 18.2.4; from 19.0.0, fixed in 19.1.0; from 20.0.0, fixed in 20.1.0; fixed in 18.2.4; from 19.0.0, fixed in 19.1.0; from 20.0.0, fixed in 20.1.0. ### [CVE-2011-4076](https://cve.now/CVE-2011-4076): OpenStack Nova before 2012.1 allows someone with access to an EC2\_ACCESS\_KEY (equivalent to a username) to obtain the EC2\_SECRET\_KEY… - Severity: Unrated - Published: Nov 26, 2019 - Affected: fixed in 12.0.0a0. ### [CVE-2019-14433](https://cve.now/CVE-2019-14433): An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. - Severity: Unrated - Published: Aug 9, 2019 - Affected: from 19.0.0, fixed in 19.0.2; fixed in 17.0.12; from 18.0.0, fixed in 18.2.2; fixed in 17.0.12; from 18.0.0, fixed in 18.2.2; from 19.0.0, fixed in 19.0.2. ### [CVE-2011-3147](https://cve.now/CVE-2011-3147): qcow format could expose host filesystem information - Severity: Low 2.8 - Published: Apr 22, 2019 - Affected: fixed in 12.0.0a0. ### [CVE-2017-18191](https://cve.now/CVE-2017-18191): An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. - Severity: Unrated - Published: Feb 19, 2018 - Affected: from 15.0.0, fixed in 15.1.1; from 16.0.0, fixed in 16.1.2; from 15.0.0, fixed in 15.1.1; from 16.0.0, fixed in 16.1.2. ### [CVE-2017-17051](https://cve.now/CVE-2017-17051): An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. - Severity: Unrated - Published: Dec 5, 2017 - Affected: fixed in 16.0.4. ### [CVE-2017-16239](https://cve.now/CVE-2017-16239): In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be… - Severity: Unrated - Published: Nov 14, 2017 - Affected: from 14.0.0, fixed in 14.0.10; from 15.0.0, fixed in 15.0.8; from 16.0.0, fixed in 16.0.3; from 16.0.0, fixed in 16.0.3; from 15.0.0, fixed in 15.0.8; from 14.0.0, fixed in 14.0.10. ### [CVE-2015-2687](https://cve.now/CVE-2015-2687): OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would… - Severity: Unrated - Published: Aug 9, 2017 - Affected: fixed in 15.0.0.0b1. ### [CVE-2017-7214](https://cve.now/CVE-2017-7214): An issue was discovered in exception\_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. - Severity: Unrated - Published: Mar 21, 2017 - Affected: from 13.0.0, fixed in 13.1.4; from 14.0.0, fixed in 14.0.5; from 15.0.1, fixed in 15.0.2; from 13.0.0, fixed in 13.1.4; from 14.0.0, fixed in 14.0.5; from 15.0.1, fixed in 15.0.2. ### [CVE-2015-5162](https://cve.now/CVE-2015-5162): The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0… - Severity: Unrated - Published: Oct 7, 2016 - Affected: fixed in 12.0.4. ### [CVE-2016-2140](https://cve.now/CVE-2016-2140): The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and… - Severity: Unrated - Published: Apr 12, 2016 - Affected: from 12.0.0, fixed in 12.0.3. ### [CVE-2015-8749](https://cve.now/CVE-2015-8749): The volume\_utils.\_parse\_volume\_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty)… - Severity: Unrated - Published: Jan 15, 2016 - Affected: from 12.0.0, fixed in 12.0.1. ### [CVE-2015-7713](https://cve.now/CVE-2015-7713): OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which… - Severity: Unrated - Published: Oct 29, 2015 - Affected: fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.2; fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.2. ### [CVE-2015-3280](https://cve.now/CVE-2015-3280): OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes… - Severity: Unrated - Published: Oct 26, 2015 - Affected: fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.2; fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.2. ### [CVE-2015-3241](https://cve.now/CVE-2015-3241): OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted… - Severity: Unrated - Published: Sep 8, 2015 - Affected: fixed in 12.0.0.0b3; fixed in 112.0.0.0b3. ### [CVE-2015-0259](https://cve.now/CVE-2015-0259): OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket… - Severity: Unrated - Published: Apr 1, 2015 - Affected: fixed in 2014.1.4; from 2014.2.0, fixed in 2014.2.3; fixed in 2014.1.4; from 2014.2.0, fixed in 2014.2.3. ### [CVE-2014-8333](https://cve.now/CVE-2014-8333): The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk… - Severity: Unrated - Published: Oct 31, 2014 - Affected: fixed in 12.0.0a0. ### [CVE-2014-3708](https://cve.now/CVE-2014-3708): OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU… - Severity: Unrated - Published: Oct 31, 2014 - Affected: fixed in 2014.1.4; from 2014.2.0, fixed in 2014.2.1; fixed in 2014.1.4; from 2014.2.0, fixed in 2014.2.1. ### [CVE-2014-3608](https://cve.now/CVE-2014-3608): The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a… - Severity: Unrated - Published: Oct 6, 2014 - Affected: fixed in 2014.1.3. ### [CVE-2014-3517](https://cve.now/CVE-2014-3517): api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying… - Severity: Unrated - Published: Aug 7, 2014 - Affected: fixed in 2013.2.4; from 2014.0.0, fixed in 2014.1.2; fixed in 2013.2.4; from 2014.0.0, fixed in 2014.1.2. ### [CVE-2014-0134](https://cve.now/CVE-2014-0134): The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images… - Severity: Unrated - Published: May 8, 2014 - Affected: fixed in 12.0.0a0. ### [CVE-2014-0167](https://cve.now/CVE-2014-0167): The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does… - Severity: Unrated - Published: Apr 15, 2014 - Affected: from 2013.1.0, fixed in 2013.2.4. ### [CVE-2014-2573](https://cve.now/CVE-2014-2573): The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote… - Severity: Unrated - Published: Mar 25, 2014 - Affected: fixed in 12.0.0a0. ### [CVE-2013-6437](https://cve.now/CVE-2013-6437): The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a… - Severity: Unrated - Published: Mar 6, 2014 - Affected: fixed in 12.0.0a0. ### [CVE-2013-7130](https://cve.now/CVE-2013-7130): The i\_create\_images\_and\_backing (aka create\_images\_and\_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and… - Severity: Unrated - Published: Feb 6, 2014 - Affected: fixed in 12.0.0a0. ### [CVE-2013-4463](https://cve.now/CVE-2013-4463): OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users… - Severity: Unrated - Published: Feb 6, 2014 - Affected: fixed in 12.0.0a0. ### [CVE-2013-7048](https://cve.now/CVE-2013-7048): OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the… - Severity: Unrated - Published: Jan 23, 2014 - Affected: fixed in 12.0.0a0. ### [CVE-2013-6419](https://cve.now/CVE-2013-6419): Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant… - Severity: Unrated - Published: Jan 7, 2014 - Affected: fixed in 12.0.0a0. ### [CVE-2013-4497](https://cve.now/CVE-2013-4497): The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when… - Severity: Unrated - Published: Nov 5, 2013 - Affected: fixed in 12.0.0a0. ### [CVE-2013-4469](https://cve.now/CVE-2013-4469): OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use\_cow\_images is set to False, does not verify the virtual size of a QCOW2… - Severity: Unrated - Published: Nov 2, 2013 - Affected: fixed in 12.0.0a0. ### [CVE-2013-4185](https://cve.now/CVE-2013-4185): Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle… - Severity: Unrated - Published: Oct 29, 2013 - Affected: fixed in 12.0.0a0. ### [CVE-2013-4278](https://cve.now/CVE-2013-4278): The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the… - Severity: Unrated - Published: Sep 16, 2013 - Affected: fixed in 12.0.0a0. ### [CVE-2013-4179](https://cve.now/CVE-2013-4179): The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to… - Severity: Unrated - Published: Sep 16, 2013 - Affected: fixed in 2013.2. ### [CVE-2013-2256](https://cve.now/CVE-2013-2256): OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is\_public property… - Severity: Unrated - Published: Sep 16, 2013 - Affected: fixed in 2013.1.3. ### [CVE-2013-2096](https://cve.now/CVE-2013-2096): OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause… - Severity: Unrated - Published: Jul 9, 2013 - Affected: fixed in 12.0.0a0. ### [CVE-2013-1838](https://cve.now/CVE-2013-1838): OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows… - Severity: Unrated - Published: Mar 22, 2013 - Affected: fixed in 12.0.0a0. ### [CVE-2013-0335](https://cve.now/CVE-2013-0335): Openstack nova: vnc proxy can connect to the wrong vm - Severity: High 7.6 - Published: Mar 22, 2013 - Affected: fixed in 12.0.0a0. ### [CVE-2012-5625](https://cve.now/CVE-2012-5625): Openstack nova: information leak in libvirt lvm-backed instances - Severity: Medium 6.5 - Published: Dec 26, 2012 - Affected: fixed in 12.0.0a0; version range not reported. ### [CVE-2012-3447](https://cve.now/CVE-2012-3447): virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to… - Severity: Unrated - Published: Aug 20, 2012 - Affected: fixed in 12.0.0; all versions. ### [CVE-2012-1585](https://cve.now/CVE-2012-1585): OpenStack Compute (Nova) Essex before 2011.3 allows remote authenticated users to cause a denial of service (Nova-API log file and disk… - Severity: Unrated - Published: Aug 17, 2012 - Affected: fixed in 12.0.0a0. ### [CVE-2012-3361](https://cve.now/CVE-2012-3361): virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to… - Severity: Unrated - Published: Jul 22, 2012 - Affected: fixed in 12.0.0a0. ### [CVE-2012-3360](https://cve.now/CVE-2012-3360): Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over… - Severity: Unrated - Published: Jul 22, 2012 - Affected: fixed in 12.0.0a0. ### [CVE-2012-3371](https://cve.now/CVE-2012-3371): The Nova scheduler in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when DifferentHostFilter or SameHostFilter is enabled… - Severity: Unrated - Published: Jul 17, 2012 - Affected: fixed in 12.0.0a0. ### [CVE-2012-2654](https://cve.now/CVE-2012-2654): The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the… - Severity: Unrated - Published: Jun 21, 2012 - Affected: fixed in 12.0.0a0. ### [CVE-2012-2101](https://cve.now/CVE-2012-2101): Openstack Compute (Nova) Folsom, 2012.1, and 2011.3 does not limit the number of security group rules, which allows remote authenticated… - Severity: Unrated - Published: Jun 7, 2012 - Affected: fixed in 12.0.0a0. ### [CVE-2011-4596](https://cve.now/CVE-2011-4596): Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage… - Severity: Unrated - Published: Dec 23, 2011 - Affected: fixed in 12.0.0a0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/nova Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.