PT-2026-38919 · Proxmox Server Solutions Gmbh+1 · Proxmox+1

Sander Grendelman · Published 2026-05-08 · Updated 2026-05-11 · CVE-2026-25199

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.21.0.0 through 4.22.0.0

Description Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. The Proxmox extension improperly uses a user-editable instance setting, proxmox vmid, to associate instances with Proxmox virtual machines. Since this value is not validated against tenant ownership and Proxmox VM IDs are predictable, a non-privileged attacker can modify the setting to reference a VM belonging to another account. This enables unauthorized cross-tenant access and full control over the targeted VM, including the ability to start, stop, and destroy it.

Recommendations Upgrade to version 4.22.0.1. Prevent users from editing the proxmox vmid instance detail by adding this detail name to the global configuration parameter user.vm.denied.details.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-25199

Affected Products

Apache Cloudstack

Proxmox

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-25199 · Security Note
• https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm · Vendor Advisory
• https://twitter.com/CVEnew/status/2053174672028528892 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/09/7 · Note
• https://twitter.com/the_yellow_fall/status/2053663130488648099 · Twitter Post
• https://t.me/cveNotify/162862 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2052758065968001229 · Twitter Post
• https://twitter.com/lyrie_ai/status/2053657737859395588 · Twitter Post