# CVE-2026-25199: Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This…

Source: https://junglewise.ai/threats/cve-2026-25199-instances-deployed-via-the-proxmox-extension-allow-unauthorized  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08  
License: CC BY 4.0 with a link back

CVE-2026-25199 · Severity: critical · CVSS 9.1 · Published 2026-05-08

Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants.




This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0.




The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmox_vmid, to associate CloudStack instances with Proxmox virtual machines. Because this value is not restricted or validated against tenant ownership and Proxmox VM IDs are predictable, a non-privileged attacker can modify the setting to reference a VM belonging to another account. This allows unauthorized cross-tenant access and enables full control over the targeted VM, including starting, stopping, and destroying the virtual machine.




Users are recommended to upgrade to version 4.22.0.1, which fixes this issue.




As a workaround for the existing installations, editing of the proxmox_vmid instance detail by users can be prevented by adding this detail name to the global configuration parameter - user.vm.denied.details.

Technologies: [Apache Cloudstack](https://junglewise.ai/threats/technologies/cloudstack). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-25199 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25199 being exploited in the wild.

**How severe is CVE-2026-25199?** Critical severity, with a CVSS score of 9.1, published 8 May 2026.

**Which products and versions are affected?** Apache Cloudstack. The advisory does not name versions.

**Is there a fix for CVE-2026-25199?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-25199?** Check whether you run Apache Cloudstack. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Apache Cloudstack

## Related threats

- [Apache CloudStack resource leak in scoped global configuration](https://junglewise.ai/threats/cve-2026-59654-apache-cloudstack-resource-leak-in-scoped-global-configuration)
- [Apache CloudStack certificate validation bypass in SAML authentication](https://junglewise.ai/threats/cve-2026-68745-apache-cloudstack-certificate-validation-bypass-in-saml)
- [Apache CloudStack improper access control in annotation APIs](https://junglewise.ai/threats/cve-2026-66797-apache-cloudstack-improper-access-control-in-annotation-apis)
- [Apache CloudStack improper authorization in project role management](https://junglewise.ai/threats/cve-2026-66722-apache-cloudstack-improper-authorization-in-project-role)
- [Apache CloudStack authorization bypass in host tags listing](https://junglewise.ai/threats/cve-2026-66721-apache-cloudstack-authorization-bypass-in-host-tags-listing)