Skip to content
VulniPulse
Critical9.1Proxmox

Critical [CVE-2026-25199] Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants

This critical-severity Proxmox advisory covers CVE-2026-25199 affecting Proxmox.

CVE-2026-25199 Published May 8, 2026Updated by vendor Jun 17, 2026
Affected products & platforms
ProxmoxUnclassified
Open vendor advisory

Android app · Google Play

Monitor future Proxmox CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Summary

Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants.

This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0.

The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmox_vmid, to associate CloudStack instances with Proxmox virtual machines.

Because this value is not restricted or validated against tenant ownership and Proxmox VM IDs are predictable, a non-privileged attacker can modify the setting to reference a VM belonging to another account.

This allows unauthorized cross-tenant access and enables full control over the targeted VM, including starting, stopping, and destroying the virtual machine.

Users are recommended to upgrade to version 4.22.0.1, which fixes this issue.

As a workaround for the existing installations, editing of the proxmox_vmid instance detail by users can be prevented by adding this detail name to the global configuration parameter - user.vm.denied.details.

Affected versions
  • through 4.22.0.0

NVD record · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions
  • 4.22.0.1

NVD record · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Users are recommended to upgrade to version 4.22.0.1, which fixes this issue.

NVD record · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.