EUVD-2026-69013
GHSA-m4j2-w8wf-vp83
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API, low complexity, authenticated tenant; scope changes as attacker crosses authorization boundary into other users' VMs with full CIA impact.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the one.vm.exec function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.
AnalysisAI
Broken authorization in OpenNebula's one.vm.exec API function allows any authenticated low-privilege user to execute arbitrary commands inside virtual machines owned by other users, across all versions prior to 7.4. The flaw stems from the platform's failure to verify whether the requesting user holds access rights to the target VM - only the VM's numeric identifier and an active qemu-agent are required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions: (1) the attacker must hold a valid OpenNebula user account with at least basic platform permissions - unauthenticated access is not sufficient (CVSS PR:L confirms authentication is required); (2) the attacker must know the numeric identifier of the target VM, which may be discoverable through legitimate API enumeration of shared cluster resources or by inference from sequential ID assignment; (3) the target VM must have the QEMU Guest Agent (qemu-agent) service installed and actively running inside the guest - this is an explicit prerequisite stated in the CVE description and is not the default state for all VM images, so VMs without qemu-agent are not exploitable via this vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 accurately reflects the real-world risk profile: network-accessible, low complexity, requiring only a valid account (PR:L), with full CIA impact on victim VMs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to OpenNebula 7.4 or later, which introduces proper access control verification in the `one.vm.exec` function; this is the only confirmed fix per the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/lack-authorisation-opennebula-opennebula-systems. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all OpenNebula deployments and determine which run versions prior to 7.4 in multi-tenant configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Opennebula
View allImproper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebu
Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content
Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery. Rated me
Stored cross-site scripting in OpenNebula v6.10.0.1 allows an attacker to persist a malicious payload inside the virtual
Stored cross-site scripting in OpenNebula 6.10.0.1 allows attackers to inject persistent malicious scripts via the user
Reflected cross-site scripting in OpenNebula 6.10.0.1 allows unauthenticated remote attackers to inject arbitrary JavaSc
Cross-site scripting in OpenNebula v6.10.0.1's custom authenticator driver enables unauthenticated remote attackers to i
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today