CVE-2026-25199 Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access
Attackers can modify instance settings to gain unauthorized control over other tenants' virtual machines in Apache CloudStack with the Proxmox extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25199?
CVE-2026-25199 is a critical missing authorization vulnerability in Apache Cloudstack, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants.
This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0.
The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmox_vmid, to associate CloudStack instances with Proxmox virtual machines. Because this value is not restricted or validated against tenant ownership and Proxmox VM IDs are predictable, a non-privileged attacker can modify the setting to reference a VM belonging to another account. This allows unauthorized cross-tenant access and enables full control over the targeted VM, including starting, stopping, and destroying the virtual machine.
Users are recommended to upgrade to version 4.22.0.1, which fixes this issue.
As a workaround for the existing installations, editing of the proxmox_vmid instance detail by users can be prevented by adding this detail name to the global configuration parameter - user.vm.denied.details.
Weakness: CWE-200
Which versions are affected by CVE-2026-25199?
It affects 1 product.
Products include Apache Cloudstack.
How do I fix CVE-2026-25199?
No fix has been published for CVE-2026-25199 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-25199 being exploited?
There is no known exploitation of CVE-2026-25199 in the wild and no public exploit code.
Other vulnerabilities in Apache Cloudstack
- CVE-2012-4501 Missing authorization in n/a
- CVE-2024-38346 Apache CloudStack: Unauthenticated cluster service port leads to remote execution
- CVE-2024-39864 Apache CloudStack: Integration API service uses dynamic port when disabled
- CVE-2024-29006 Apache CloudStack: x-forwarded-for HTTP header parsed by default
- CVE-2022-35741 Apache CloudStack SAML Single Sign-On XXE
Sources
Also known as GHSA-whfq-93mc-cv6g.