Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access
Published May 8, 2026
9.1
CRITICALCVSS 3.1
EPSS 0.50%
Description
Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants.
This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0.
The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmox_vmid, to associate CloudStack instances with Proxmox virtual machines. Because this value is not restricted or validated against tenant ownership and Proxmox VM IDs are predictable, a non-privileged attacker can modify the setting to reference a VM belonging to another account. This allows unauthorized cross-tenant access and enables full control over the targeted VM, including starting, stopping, and destroying the virtual machine.
Users are recommended to upgrade to version 4.22.0.1, which fixes this issue.
As a workaround for the existing installations, editing of the proxmox_vmid instance detail by users can be prevented by adding this detail name to the global configuration parameter - user.vm.denied.details.
Affected products
-
- Version 4.21.0StatusaffectedConstraints<=4.22.0
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | unaffected |
|
- ≥ 4.21.0.0 · < 4.22.0.1
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
TotalDecision
n/aAssessed May 8, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
Score over time
May–Oct 2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 0.50% (0.00500) | 40.69th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.50% (0.00500) | 38.62th | v5 (v2026.06.15) |
| May 9, 2026 | 0.03% (0.00027) | 7.80th | v4 (v2025.03.14) |
References (2)
- http://www.openwall.com/lists/oss-security/2026/05/09/7
- https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm vendor-advisoryMailing ListVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/09/7 | ||
| https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm | vendor-advisoryMailing ListVendor Advisory |
Change history (0)
No recorded changes yet.