CVE-2026-25199: Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access
Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants.
This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0.
The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmoxvmid, to associate CloudStack instances with Proxmox virtual machines. Because this value is not restricted or validated against tenant ownership and Proxmox VM IDs are predictable, a non-privileged attacker can modify the setting to reference a VM belonging to another account. This allows unauthorized cross-tenant access and enables full control over the targeted VM, including starting, stopping, and destroying the virtual machine.
Users are recommended to upgrade to version 4.22.0.1, which fixes this issue.
As a workaround for the existing installations, editing of the proxmoxvmid instance detail by users can be prevented by adding this detail name to the global configuration parameter - user.vm.denied.details.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25199?
CVE-2026-25199 is considered a significant security vulnerability that allows unauthorized access to instances across tenant boundaries.
How do I fix CVE-2026-25199?
To fix CVE-2026-25199, it is recommended to upgrade Apache CloudStack to a version later than 4.22.0.0.
What versions of Apache CloudStack are affected by CVE-2026-25199?
CVE-2026-25199 affects Apache CloudStack versions from 4.21.0.0 to 4.22.0.0.
What is the impact of CVE-2026-25199?
The impact of CVE-2026-25199 is unauthorized cross-tenant access to instances, potentially compromising sensitive data and resources.
Is there a workaround for CVE-2026-25199?
Currently, the best approach for CVE-2026-25199 is to upgrade to a patched version of Apache CloudStack, as there are no known effective workarounds.