WEBVIRTCLOUD · CVE-2026-122224 · Other
NO FIX YET · SEE WHAT TO DO
WebVirtCloud, a web panel for managing KVM virtual machines, does not declare permission checks on its migrate and instance-create API endpoints, so Django REST Framework allows any logged-in user through. An authenticated low-privileged user can migrate or undefine other users' virtual machines and create volumes and domains on any compute host.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted WebVirtCloud panels at or before commit bb920b0 that have non-admin accounts. Any logged-in user can migrate or undefine other users' VMs and create volumes and domains on any compute host. Panels with only trusted admin accounts, or not reachable by untrusted users, are at much lower risk.
Not affected if admin-only-users, no-network-access, no-untrusted-accounts, single-user-install
Who cares kvm, self-hosted, virtualization, webvirtcloud
Posts are quoted with a link to the original. They are data to us, never instructions.
WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.