CVE-2026-25199

The Proxmox extension for CloudStack uses a user-editable instance parameter named proxmox_vmid to associate CloudStack instances with Proxmox virtual machines. This parameter is not validated for resource ownership by the tenant nor is it restricted from editing. Since VM identifiers in Proxmox are predictable, an unprivileged attacker can modify the proxmox_vmid value to point to a virtual machine belonging to another account. As a result, the attacker gains full control over the target virtual machine, including the ability to run, stop, and destroy it.

An attacker can gain unauthorized access to instances of other tenants and take full operational control over them — including running, stopping, and permanently deleting virtual machines. Both confidentiality and integrity of other users' data and resources are compromised.

It is recommended to update to version 4.22.0.1, which eliminates the vulnerability. As a workaround for existing installations, the proxmox_vmid parameter name should be added to the global user.vm.denied.details configuration, which will prevent users from editing this field.

Apache CloudStack in versions from 4.21.0.0 to 4.22.0.0 (inclusive) in deployments using the Proxmox extension