OpenNebula versions prior to 7.4 are vulnerable to an access control flaw that allows authenticated users to execute commands on arbitrary virtual machines, posing a high risk to cloud infrastructure.

This vulnerability is an improper access control issue (CWE-284) within the one.vm.exec function. It allows an authenticated user with basic permissions to bypass security checks and execute commands on virtual machines belonging to other users, provided the qemu-agent is enabled and the target virtual machine identifier is known.

The ability for a standard user to execute commands on virtual machines they do not own constitutes a severe breach of multi-tenant isolation. With a CVSS score of 8.7, this vulnerability represents a high risk to the confidentiality, integrity, and availability of sensitive workloads hosted within the OpenNebula environment. Successful exploitation could lead to unauthorized data access, system disruption, and complete compromise of guest virtual machines.

Immediate Action: Update the OpenNebula deployment to version 7.4 or later to resolve the underlying access control logic error.

Proactive Monitoring: Review administrative and user access logs for suspicious calls to the one.vm.exec function, particularly those targeting virtual machines outside of the user's assigned scope.

Compensating Controls: Disable the qemu-agent on virtual machines where it is not strictly required to minimize the attack surface until the patch can be applied.

Public Exploit Available: No

Given the high CVSS score and the direct impact on virtual machine isolation, this vulnerability should be treated as a priority for remediation. Organizations using OpenNebula must verify their current version and schedule an upgrade to 7.4 immediately to prevent potential unauthorized command execution by malicious or compromised internal accounts.