CVE-2026-84165

CVE-2026-84165 is an improper access control flaw (CWE-284) in OpenNebula, the open-source cloud and virtualization platform from OpenNebula Systems, in which the one.vm.exec function does not verify whether the calling user is permitted to access the target virtual machine. An authenticated attacker with only basic (low-privilege) permissions can invoke one.vm.exec against any virtual machine whose identifier they know, provided qemu-guest-agent is enabled on that VM, causing arbitrary commands to be executed inside it through the guest agent. Because virtual machine identifiers are simple, guessable IDs, any low-privilege user in a multi-tenant OpenNebula deployment can run commands in other users' VMs, compromising their confidentiality, integrity and availability. All OpenNebula versions prior to 7.4 are affected, so unpatched multi-tenant OpenNebula clouds are exposed wherever unprivileged users and the guest agent are in use. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS estimates about a 0.5% probability of exploitation in the next 30 days, so no exploitation is currently known.

What to do: Upgrade to OpenNebula 7.4 or later. If an upgrade is not immediately possible, restrict which users/ACLs can invoke one.vm.exec and disable qemu-guest-agent on virtual machines shared across users, and review guest-agent logs for unexpected command execution.