CVE-2026-84165: Lack of authorisation in OpenNebula by OpenNebula Systems
A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the one.vm.exec function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenNebulato a version that resolves this vulnerability.Fixed in 7.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenNebula user with basic permissions can exploit it. The attacker needs to know the identifier of a target virtual machine owned by another user.
Which virtual machines are exposed?
A target virtual machine is exposed when qemu-agent is enabled on it. The issue affects OpenNebula versions prior to 7.4.
What is the impact of successful exploitation?
An attacker can execute commands on other users' virtual machines through the one.vm.exec function. This can compromise the confidentiality, integrity, and availability of those virtual machines.