What’s Vulnerable › Vulnerabilities
CVE-2026-84165: Lack of authorisation in OpenNebula by OpenNebula Systems
- Severity: high (CVSS 8.7 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-01 · updated 2026-09-01
- Weakness: CWE-284
Description
A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.
Affected products
- OpenNebula Systems OpenNebula: before 7.4 — fixed in 7.4
How to fix
Upgrade to a fixed version: OpenNebula Systems OpenNebula 7.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-84165 or the next vulnerability affects your stack