dbcve.org
CloudstackApplication · Apache

CVE-2026-25199

CRITICAL · 9.1 CVSS v3.1 Published 2026-05-08
Fix available
A fix is available. Upgrade to 4.22.0.1 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0. The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmox_vmid, to associate CloudStack instances with Proxmox virtual machines. Because this value is not restricted or validated against tenant ownership and Proxmox VM IDs are predictable, a non-privileged attacker can modify the setting to reference a VM belonging to another account. This allows unauthorized cross-tenant access and enables full control over the targeted VM, including starting, stopping, and destroying the virtual machine. Users are recommended to upgrade to version 4.22.0.1, which fixes this issue. As a workaround for the existing installations, editing of the proxmox_vmid instance detail by users can be prevented by adding this detail name to the global configuration parameter - user.vm.denied.details.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Proxmox extension for Apache CloudStack fails to validate that the user-editable proxmox_vmid instance detail belongs to the caller's tenant before associating it with a Proxmox VM. Since Proxmox VM IDs are predictable and this setting is not restricted, an attacker in one tenant can modify their VM's proxmox_vmid to point at another tenant's Proxmox VM, achieving unauthorized cross-tenant access and full control (start, stop, destroy).

MitigationUpgrade to Apache CloudStack 4.22.0.1, or alternatively add 'proxmox_vmid' to the user.vm.denied.details global configuration to prevent users from editing this field.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
CloudstackApplication
Affected:>= 4.21.0.0, < 4.22.0.1

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Apache CloudStack version
    Retrieve the installed CloudStack version from the management server (commonly via the UI or API command 'listConfigs' with name='cloudstack.version' or similar version query command)
    Affected if The installed version is >= 4.21.0.0 and < 4.22.0.1
  2. Confirm Proxmox extension is deployed
    Check if the Proxmox integration is enabled in CloudStack (look for Proxmox-related hosts, cluster configurations, or the presence of the Proxmox resource/segment in the cloud setup)
    Affected if Proxmox hypervisor clusters or hosts are configured in the CloudStack environment
  3. Verify user editability of proxmox_vmid
    Check the global configuration setting 'user.vm.denied.details' or inspect whether users can edit the proxmox_vmid instance detail on their VMs via API or UI
    Affected if The proxmox_vmid field is NOT listed in user.vm.denied.details, meaning users can modify this instance detail
  4. Check for cross-tenant VM associations
    Review VM instance details for any proxmox_vmid values that map to VMs outside the owning tenant, or examine API audit logs for unexpected VM operations on foreign tenant resources
    Affected if Any VM instance has a proxmox_vmid pointing to a Proxmox VM ID belonging to a different tenant

You are affected if running CloudStack 4.21.0.0 through 4.22.0.0 with the Proxmox extension enabled and the proxmox_vmid detail is user-editable (not blocked by user.vm.denied.details configuration).

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 4.22.0.1 or later
Fixed in 4.22.0.1
Interim mitigation

Upgrade to Apache CloudStack 4.22.0.1, or alternatively add 'proxmox_vmid' to the user.vm.denied.details global configuration to prevent users from editing this field.

Recommended fix High confidence

4.22.0.1

  1. 1. Plan and schedule a maintenance window for the CloudStack management server upgrade.
  2. 2. Back up the CloudStack database and configuration files before proceeding.
  3. 3. Stop the CloudStack management server service.
  4. 4. Upgrade Apache CloudStack to version 4.22.0.1 or later.
  5. 5. Verify the upgrade was successful by checking the management server logs.
  6. 6. Restart the CloudStack management server service.
  7. 7. Validate that the Proxmox extension functions correctly with the new version.

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Cloudstack Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing4.0 h
  • Review / QA2.0 h
18.0 hours of engineering $3,200
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-25199 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-25199 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data