Executive brief
OpenNebula is a cloud management platform used to provision and manage virtual machines across data centers. An authenticated user with basic permissions can execute arbitrary commands on virtual machines belonging to other users by directly calling the vm.exec function, bypassing access control checks. This allows an attacker to compromise confidentiality, integrity, and availability of VMs across the infrastructure without administrator intervention.
Technical details
The vulnerability is an authorization bypass in OpenNebula's vm.exec function. The root cause is insufficient verification of user access permissions before executing commands on virtual machines. An authenticated attacker with basic user privileges can directly invoke one.vm.exec with a target VM identifier (only the VM ID needs to be known) to execute arbitrary commands on VMs owned by other users, provided qemu-agent is enabled on the target VM. This allows remote code execution on arbitrary VMs without proper access control enforcement. The vulnerability affects all versions prior to 7.4.
Affected products
- OpenNebula Systems OpenNebula prior to 7.4
Timeline
- 2026-09-01: disclosed