CVE-2026-25199 in CloudStack
Summary
by MITRE • 05/08/2026
Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants.
This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0.
The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmox_vmid, to associate CloudStack instances with Proxmox virtual machines. Because this value is not restricted or validated against tenant ownership and Proxmox VM IDs are predictable, a non-privileged attacker can modify the setting to reference a VM belonging to another account. This allows unauthorized cross-tenant access and enables full control over the targeted VM, including starting, stopping, and destroying the virtual machine.
Users are recommended to upgrade to version 4.22.0.1, which fixes this issue.
As a workaround for the existing installations, editing of the proxmox_vmid instance detail by users can be prevented by adding this detail name to the global configuration parameter - user.vm.denied.details.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/10/2026
This vulnerability represents a critical cross-tenant access flaw within Apache CloudStack deployments utilizing the Proxmox extension, where unauthorized users can gain full administrative control over virtual machines belonging to other tenants. The issue stems from improper validation mechanisms within the CloudStack platform that fails to enforce tenant isolation when processing the proxmox_vmid parameter, creating a direct pathway for privilege escalation and unauthorized resource manipulation. The vulnerability specifically impacts CloudStack versions ranging from 4.21.0.0 through 4.22.0.0, affecting organizations that rely on Proxmox hypervisor integration for their cloud infrastructure deployments. This represents a fundamental failure in access control enforcement and resource ownership validation that violates core security principles of multi-tenant cloud environments.
The technical implementation flaw occurs when the Proxmox extension processes the proxmox_vmid instance setting, which serves as a direct mapping between CloudStack instances and underlying Proxmox virtual machine identifiers. Since this value is user-editable and lacks proper validation against tenant ownership boundaries, attackers can manipulate this parameter to reference any Proxmox VM ID within the system. The predictability of Proxmox VM IDs further amplifies the risk, as attackers can systematically enumerate valid identifiers without requiring additional reconnaissance. This vulnerability directly maps to CWE-284 (Improper Access Control) and CWE-352 (Cross-Site Request Forgery) categories, representing a clear violation of the principle of least privilege and proper resource isolation. The flaw enables attackers to execute arbitrary operations on target virtual machines including starting, stopping, and destroying instances, effectively providing complete administrative control over the compromised resources.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it fundamentally undermines the security model of multi-tenant cloud deployments. Attackers can leverage this vulnerability to perform destructive operations such as VM destruction, data exfiltration, and service disruption across multiple tenant environments. The vulnerability enables lateral movement within the cloud infrastructure and can facilitate more sophisticated attacks including privilege escalation, data theft, and persistent access. Organizations using CloudStack with Proxmox extensions face significant risk of data breaches, service interruptions, and compliance violations, particularly in regulated environments where tenant isolation is mandatory. This vulnerability aligns with ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing) as attackers can exploit this flaw to gain unauthorized access to resources they should not be able to control, potentially leading to broader compromise of the cloud infrastructure.
The recommended solution involves upgrading to CloudStack version 4.22.0.1, which implements proper validation mechanisms to prevent unauthorized cross-tenant VM associations. This upgrade addresses the root cause by enforcing tenant ownership validation when processing the proxmox_vmid parameter, ensuring that users can only reference VMs within their own tenant scope. For organizations unable to immediately upgrade, the recommended workaround involves configuring the global parameter user.vm.denied.details to prevent user modification of the proxmox_vmid instance detail. This configuration effectively removes the ability for users to manipulate this critical parameter, thereby preventing the exploitation of the vulnerability while maintaining system functionality. Security teams should also implement monitoring for unauthorized modifications to instance details and conduct regular audits of VM ownership mappings to detect potential exploitation attempts. The vulnerability demonstrates the critical importance of proper input validation and access control enforcement in cloud infrastructure management systems, particularly when integrating with external hypervisor platforms that may have predictable resource identifiers.