Instances deployed using the Proxmox extension are linked to Proxmox virtual machines through a user‑editable detail, proxmox_vmid. Because this value is neither restricted nor validated against tenant ownership, an attacker who can modify instance details can point their instance to another tenant’s virtual machine. That attacker then gains complete operational control over the targeted VM—starting, stopping, or destroying it—without needing higher privileges or cloud‑network access. The weakness is a confidentiality breach (CWE‑200).

The vulnerability resides in the Proxmox extension for Apache CloudStack, affecting all releases from 4.21.0.0 up through 4.22.0.0. Any tenant using those versions with the Proxmox integration is susceptible.

The CVSS score is 9.1, indicating severe risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is modification of the proxmox_vmid detail via CloudStack’s API or web console, which can be performed by a non‑privileged user on their own instance. Because Proxmox VM IDs are predictable and unchecked, an attacker can pivot across tenants, making exploitation realistic in an environment where tenant isolation is expected.