[<prev] [day] [month] [year] [list]
Message-ID: <59b3a1d7-b7e5-445a-b8e9-45fd55a8f36b@apache.org>
Date: Fri, 8 May 2026 14:22:37 +0200
From: "Piotr P. Karwasz" <pkarwasz@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-25199: Apache CloudStack: Proxmox Extension Allows
Unauthorized Cross-Tenant Instance Access
Severity: moderate
Affected versions:
- Apache CloudStack 4.21.0 through 4.22.0
Description:
Instances deployed via the Proxmox extension allow unauthorized access
to instances belonging to other tenants.
This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0.
The Proxmox extension for CloudStack improperly uses a user-editable
instance setting, proxmox_vmid, to associate CloudStack instances with
Proxmox virtual machines. Because this value is not restricted or
validated against tenant ownership and Proxmox VM IDs are predictable, a
non-privileged attacker can modify the setting to reference a VM
belonging to another account. This allows unauthorized cross-tenant
access and enables full control over the targeted VM, including
starting, stopping, and destroying the virtual machine.
Users are recommended to upgrade to version 4.22.0.1, which fixes this
issue.
As a workaround for the existing installations, editing of the
proxmox_vmid instance detail by users can be prevented by adding this
detail name to the global configuration parameter - user.vm.denied.details.
Credit:
Sander Grendelman <sander.grendelman@...ans.com> (reporter)
References:
https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm
https://cloudstack.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-25199
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
