OpenNebula: one.vm.exec skips the permission check, letting any user run commands in other tenants' VMs

Impact

An authenticated user with only basic permissions can call one.vm.exec against a VM belonging to someone else and have the command run inside it, with no ownership or ACL verification. The only prerequisites are the target VM's identifier - small sequential integers, so enumeration is trivial - and qemu-guest-agent enabled in that VM. On an OpenNebula cloud handing out GPU passthrough or vGPU instances, this is direct cross-tenant compromise of running training jobs: datasets, credentials, checkpoints and model weights, plus code execution on a guest that holds accelerator devices. Affects all versions prior to 7.4.

Who can reach it

Any authenticated OpenNebula user with basic permissions, over the XML-RPC/API interface. Needs the target VM's numeric id and qemu-guest-agent running in that VM; no administrative role required.

What to do

Upgrade OpenNebula to 7.4 and restart the management daemon - the fix lives in the front-end authorization path, so tenant VMs and GPU nodes do not need to be drained or rebooted. If the upgrade cannot happen tonight, removing qemu-guest-agent from tenant VM templates (and from running guests) closes the execution path, at the cost of losing guest-agent features. Review API logs for one.vm.exec calls against VMs the caller does not own.

References

Related entries

• HPE iLO3/4/5: Remote unauthenticated denial of service against the management controllerCVE-2018-7093 · HPE iLO3/4/5High
• NAKIVO Backup & Replication: Unauthenticated absolute path traversal via getImageByPathCVE-2024-48248 · NAKIVO Backup & ReplicationHigh
• Socomec DIRIS Digiware M-70 1.6.9 (Modbus TCP and Modbus RTU-over-TCP): A large cluster of unauthenticated ModbusCVE-2024-48882 · Socomec DIRIS Digiware M-70 1.6.9 (Modbus TCP and Modbus RTU-over-TCP)High
• Ivanti Endpoint Manager (EPM): Auth bypass via alternate pathCVE-2026-1603 · Ivanti Endpoint Manager (EPM)High
• Pure Storage FlashArray Purity (management interface privilege bypass): An authenticated low-privileged user reachesCVE-2026-6444 · Pure Storage FlashArray Purity (management interface privilege bypass)High
• rclone (serve restic): Path validation in serve restic is incomplete, so an authenticated caller escapes the configuredCVE-2026-71309 · rclone (serve restic)High