Vulnerability Description
A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-84165?
CVE-2026-84165 is a documented vulnerability. A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissio...
How severe is CVE-2026-84165?
CVSS scoring is not yet available for CVE-2026-84165. Check NVD for updates.
Is there a patch for CVE-2026-84165?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.