[Hardening] F-16: Weak Default Password on System VMs. #14075

Activity

1. github-actions

   added

   component:csvm

   component:ssvm

   component:virtual-router

   type:security

   on Sep 8, 2026
2. github-actions commented on Sep 8, 2026

   

   github-actionsBot

   on Sep 8, 2026 – with GitHub Actions

   More actions

   🎯 Triage report

   Reports that CloudStack System VMs (SSVM, CPVM, VR) ship with a hard-coded default password (root/password), which is publicly documented and could be exploited by an attacker with console access. The author notes that password randomization already exists as an opt-in feature, so this is primarily a "make it the secure default" request plus a documentation ask.

   📊 Assessment

   Dimension	Value	Reasoning
   Type	type:security	Describes a weak-by-default credential configuration with a documented attack path.
   Component	component:ssvm, component:csvm, component:virtual-router	All three System VM types are explicitly named as affected.
   Severity	n/a (no Severity label applied)	Requires console access to exploit rather than being remotely exploitable; author frames this as a hardening/default-config issue rather than an active bug, so severity is left to maintainer judgment.
   Labels	type:security, component:ssvm, component:csvm, component:virtual-router	See above.
   Coding agent	Needs more info	The underlying randomization feature already exists per the author; the actual code change (flipping the default) is small, but deciding whether to change the default (upgrade/compatibility impact) is a policy decision for maintainers. Documentation-only portion could be agent-suitable.

   🔗 Similar issues

   No open duplicate or closely related open issue was found in a search for default System VM passwords.

   💡 Notes and suggestions

   • Companion report from the same author: [Hardening] F-01: Failure to Initialize a Secure Transport Layer (TLS) During Out-of-the-Box Setup. #14074 (TLS not enabled by default). Maintainers may want to track these "[Hardening] F-xx" reports together.
   • Author states the randomization feature already exists — worth confirming the relevant global setting/flag (e.g. system.vm.random.password or similar) and whether it's simply disabled by default today.
   • If maintainers agree to change the default, this would need release-notes/upgrade documentation since it changes default admin console credentials for existing and new deployments.
   • Consider whether this should go through the project's private security disclosure process per SECURITY.md, though the author has already filed it publicly and notes it's a known/documented behavior.

   Generated by Daily Issue Triage · sonnet50 110.8K · ◷

   Add this agentic workflows to your repo

   To install this agentic workflow, run

   gh aw add githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9
   
3. DaanHoogland

   changed the title [-][Hardening] F-17: Weak Default Password on System VMs.[/-] [+]Weak Default Password on System VMs.[/+] on Sep 9, 2026
4. DaanHoogland

   added the

   Task

   issue type on Sep 9, 2026
5. DaanHoogland

   added this to the 24.0 milestone on Sep 9, 2026
6. RosiKyu commented on Sep 30, 2026

   

   RosiKyu

   on Sep 30, 2026

   Collaborator

   More actions

   @davift are you planning to submit a PR to address this for the upcoming 24.0 release?
7. davift commented on Sep 30, 2026

   

   davift

   on Sep 30, 2026

   Author

   More actions

   @davift are you planning to submit a PR to address this for the upcoming 24.0 release?

   Dear @RosiKyu , I wish i had the necessary competencies to take care of this issue myself but that is not the case.

   Feel free to assign the issue to yourself of that is in your intentions.

   Thank you for asking, though.
8. davift

   changed the title [-]Weak Default Password on System VMs.[/-] [+][Hardening] F-16: Weak Default Password on System VMs.[/+] on Oct 6, 2026
9. nvazquez

   modified the milestones: 24.0, 25.0 on Oct 30, 2026