CVE-2026-25199: Apache CloudStack Proxmox Extension: Cross-Tenant Instance Access
CVE-2026-25199 affects the Proxmox extension of Apache CloudStack, which relies on a user-editable instance setting to map CloudStack instances to Proxmox virtual machines without a tenant ownership check. The advisory states this can allow unauthorized access to VMs of other tenants, including starting, stopping and destroying them. The record reports CVSS 3.1 score 9.1, recommends upgrading to 4.22.0.1, and shows no confirmed exploitation in the sources consulted.
Overview
CVE-2026-25199 is a critical issue in the Proxmox extension of Apache CloudStack. According to the record, the extension uses the user-editable instance detail proxmox_vmid to link CloudStack instances to Proxmox virtual machines, and this link is not checked against tenant ownership.
Impact
The description states that a non-privileged user could change this setting to reference a VM owned by another account. The record says this enables unauthorized cross-tenant access and full control of the targeted VM, including starting, stopping and destroying it. The CNA and CISA-ADP both score the issue CVSS 3.1 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The weakness is mapped to CWE-200.
Affected products and versions
The record lists Apache Software Foundation CloudStack. The description states the issue affects versions from 4.21.0.0 through 4.22.0.0, and the affected entries describe the range as at least 4.21.0.0 and below 4.22.0.1.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed active exploitation appears in the sources consulted. The EPSS probability is 0.005 and the SSVC exploitation field is none, while the SSVC automatable field is yes.
Remediation and mitigation
- Upgrade CloudStack to version 4.22.0.1, which the description says fixes this issue.
- For installations that cannot upgrade immediately, the description recommends adding the detail name proxmox_vmid to the global configuration parameter user.vm.denied.details, which prevents users from editing that detail.
- Review existing instance details that link CloudStack instances to Proxmox VMs for mismatches with tenant ownership.
Detection guidance
- Review audit and configuration records for changes to the proxmox_vmid instance detail, especially changes made by non-administrative accounts.
- Check whether CloudStack instances map to Proxmox VMs that belong to other accounts or tenants.
- Monitor unexpected power-state changes or deletions of Proxmox VMs that correlate with tenant activity.
Limitations of the available information
The record has an empty fixes field, so the fixing commit or patch details are not available here; the fixed version comes from the description. No public exploit details are provided in the record, and this analysis does not address other distributions or forks. Whether the workaround covers every access path is not stated.
Frequently asked questions
Which Apache CloudStack versions are affected by CVE-2026-25199?
The description says the issue affects versions from 4.21.0.0 through 4.22.0.0. The affected entries describe the range as at least 4.21.0.0 and below 4.22.0.1.
What version fixes this issue?
The description recommends upgrading to version 4.22.0.1, which it states fixes the issue.
Is this vulnerability known to be exploited?
The CISA KEV catalog does not list this CVE in the record, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.