CVE-2026-25199
CVE-2026-25199: 1 tracked advisory record across Proxmox. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Proxmox
1 advisory- Advisory severityCritical9.1
Critical [CVE-2026-25199] Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants
CVE-2026-25199Source published Source updated
Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0. The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmox_vmid, to associate CloudStack instances with Proxmox virtual machines. Because this value is not restricted or validated against tenant ownership and Proxmox VM IDs are predictable, a non-privileged attacker can modify the setting to reference a VM belonging to another account. This allows unauthorized cross-tenant access and enables full control over the targeted VM, including starting, stopping, and destroying the virtual machine. Users are recommended to upgrade to version 4.22.0.1, which fixes this issue. As a…
- Related products — impact not confirmed
- Proxmox
- Source-reported affected versions
- through 4.22.0.0
- Source-reported fixed versions
- 4.22.0.1
- Mitigation guidance
- Users are recommended to upgrade to version 4.22.0.1, which fixes this issue.
Android app · Google Play
Monitor future Proxmox CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.