github-actions[bot] commented on issue #14075: URL: https://github.com/apache/cloudstack/issues/14075#issuecomment-5590041677
## ๐ฏ Triage report Reports that CloudStack System VMs (SSVM, CPVM, VR) ship with a hard-coded default password (`root`/`password`), which is publicly documented and could be exploited by an attacker with console access. The author notes that password randomization already exists as an opt-in feature, so this is primarily a "make it the secure default" request plus a documentation ask. ### ๐ Assessment | Dimension | Value | Reasoning | |---|---|---| | **Type** | `type:security` | Describes a weak-by-default credential configuration with a documented attack path. | | **Component** | `component:ssvm`, `component:csvm`, `component:virtual-router` | All three System VM types are explicitly named as affected. | | **Severity** | n/a (no Severity label applied) | Requires console access to exploit rather than being remotely exploitable; author frames this as a hardening/default-config issue rather than an active bug, so severity is left to maintainer judgment. | | **Labels** | type:security, component:ssvm, component:csvm, component:virtual-router | See above. | | **Coding agent** | Needs more info | The underlying randomization feature already exists per the author; the actual code change (flipping the default) is small, but deciding whether to change the default (upgrade/compatibility impact) is a policy decision for maintainers. Documentation-only portion could be agent-suitable. | ### ๐ Similar issues No open duplicate or closely related open issue was found in a search for default System VM passwords. <details><summary>๐ก Notes and suggestions</summary> - Companion report from the same author: #14074 (TLS not enabled by default). Maintainers may want to track these "[Hardening] F-xx" reports together. - Author states the randomization feature already exists โ worth confirming the relevant global setting/flag (e.g. `system.vm.random.password` or similar) and whether it's simply disabled by default today. - If maintainers agree to change the default, this would need release-notes/upgrade documentation since it changes default admin console credentials for existing and new deployments. - Consider whether this should go through the project's private security disclosure process per SECURITY.md, though the author has already filed it publicly and notes it's a known/documented behavior. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/34232516163) ยท sonnet50 110.8K ยท [โท](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) > <details> <summary>Add this agentic workflows to your repo</summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9 ``` </details> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, version: 1.0.52, model: claude-sonnet-5, id: 34232516163, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/34232516163 --> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
