CVE-2026-84165
Received Received - Intake

Incorrect Access Control in OpenNebula Allows VM Command Execution

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84165
EUVD
EUVD-2026-69013

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opennebula_systems opennebula to 7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84165 is an incorrect access control flaw in OpenNebula versions before 7.4. It allows authenticated users with basic permissions to run commands on other users' virtual machines using the one.vm.exec function without proper permission checks. Exploitation requires knowing the VM's ID and qemu-agent being enabled.

Detection Guidance

Check OpenNebula version with 'oneacct --version' or 'cat /usr/lib/one/version'. Verify if qemu-agent is enabled on VMs using 'virsh list' and 'virsh qemu-agent-command <vm-id> --json '{"execute":"guest-ping"}''. Monitor logs for unauthorized 'one.vm.exec' calls in OpenNebula logs.

Impact Analysis

This vulnerability could let attackers execute arbitrary commands on your virtual machines, potentially leading to data theft, system damage, or unauthorized access. It compromises confidentiality, integrity, and availability of affected VMs.

Compliance Impact

This vulnerability could lead to unauthorized access and command execution on virtual machines, potentially exposing sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by compromising confidentiality and integrity of stored information.

Mitigation Strategies

Update OpenNebula to version 7.4 or later immediately. Disable qemu-agent on VMs if not required. Restrict user permissions to minimum necessary. Monitor network traffic for suspicious activity targeting the 'one.vm.exec' function.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84165. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart