CVE-2026-84165
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A vulnerability related to incorrect access control in OpenNebula (all versions prior to 7.4) allows an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the one.vm.exec function, without proper verification of access permissions. To exploit, it is only necessary to know the virtual machine's identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.
Risk Assessment
The risk for the organization is unauthorized access to other users' virtual machines, potentially leading to data breaches and service disruption.
Recommendation
Immediately upgrade OpenNebula to version 7.4 or later and review access control configurations for the one.vm.exec function.
Other vulnerabilities in OpenNebula
See all- CVE-2025-56537Medium
A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the virtual network template parameter.
- CVE-2025-56536Medium
A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the user information parameter.
- CVE-2025-56535Medium
A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the zone attribute parameter.
- CVE-2025-56534Medium
A cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Original NVD description (English source)
A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS