Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Weak Default Password on System VMs.

Open
#14,075 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
java
Domain
cloud, infrastructure, security

Research direction

Start by locating the existing System VM password-randomization feature and the documentation proposed in this issue; no specific files or tests are named. Check how the behavior applies to SSVM, CPVM, and VR, including its configuration default and opt-out. Done means passwords are randomized by default and administrators can still disable the behavior, with the usage documented clearly.

Written by the indexing model from the issue text.

Description

component:csvm component:ssvm component:virtual-router type:security
The required feature described as a wish

Description: By default, CloudStack uses a hard-coded password for all System VMs.

Affected Components: System VMs (SSVM, CPVM, and VR)

Impact: An attacker who knows the default credentials, which are publicly documented, and has console access to any System VM could log in as root.

  • On a VR: the attacker could act as a man-in-the-middle (MITM).
  • On a SSVM: the attacker could tamper with templates and ISOs, and delete snapshots.
  • On a CPVM: the attacker could potentially install a keylogger on noVNC sessions.

Steps to Reproduce:

  • Open the Console of any System VM.
  • Enter the default username root and password password.

Recommended Remediation: Enable randomization of System VM passwords by default, while allowing administrators to disable this behavior if needed.

Note: This feature already exists. Additionally, documentation improvements have been proposed to clarify how to enable and use it.

Dominant language
Java
Stars
3.1k
Forks
1.4k
Avg merge
6d 20h
Merged PRs (30d)
27

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/cloudstack

All issues in apache/cloudstack

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.