The Apache CloudStack project has just announced the LTS release of Apache CloudStack 4.20.3.1 and 4.22.1.1 to address multiple security vulnerabilities affecting several CloudStack components and integrations.
These release addresses a range of security issues, including remote code execution, server-side request forgery (SSRF), cross-site scripting (XSS), database-level sensitive information disclosure, and unauthorized access to cloud resources.
The affected areas span multiple parts of the platform: backup repository configuration, template and ISO registration, and diagnostics retrieval for system VMs and virtual routers (VRs); authentication and identity handling, including OAuth provider listing, Google OAuth provider usage, and two-factor authentication secret storage; and core platform components such as webhook delivery handling, project entities, Kubernetes cluster nodes, host tags listing, the async job framework, and cross-tenant boundaries.
Several of the reported issues may allow authenticated users to access or manipulate resources outside their intended scope.
The following CVEs are addressed in these releases:
– CVE-2026-47359 (severity ‘Low’)
– CVE-2026-50112 (severity ‘Critical’)
– CVE-2026-50222 (severity ‘Important’)
– CVE-2026-59085 (severity ‘Moderate’)
– CVE-2026-59655 (severity ‘Moderate’)
– CVE-2026-59657 (severity ‘Low’)
– CVE-2026-59780 (severity ‘Low’)
– CVE-2026-59799 (severity ‘Important’)
– CVE-2026-61397 (severity ‘Critical’)
– CVE-2026-61398 (severity ‘Low’)
– CVE-2026-61399 (severity ‘Low’)
– CVE-2026-61400 (severity ‘Low’)
– CVE-2026-61422 (severity ‘Low’)
– CVE-2026-62440 (severity ‘Important’)
– CVE-2026-65613 (severity ‘Moderate’)
– CVE-2026-66721 (severity ‘Moderate’)
– CVE-2026-66722 (severity ‘Moderate’)
– CVE-2026-66797 (severity ‘Low’)
– CVE-2026-68745 (severity ‘Important’)
CVE-2026-47359: OS Command Injection due to unsanitized mount command
Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache CloudStack’s NAS backup provider plugin. The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when any account subsequently performs a backup restore.
Affected versions:
– Apache CloudStack 4.20.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-50112: RCE and SSRF in direct download, metalink and NFS templates
SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.
RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads: An authenticated CloudStack tenant holding the default User role can execute arbitrary shell commands as root on the KVM hypervisor host that runs other tenants’ VMs. This is cross-tenant root on the underlying compute, reachable via the public CloudStack API.
When a User registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and dispatches download to the KVM agent. Inner URLs inside the metalink XML are never re-validated against the scheme allowlist.
Affected versions:
– Apache CloudStack 4.14.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-50222: Improper access control in Userdata reference APIs
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack’s Userdata reference APIs.
Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to
userdata resources that belong to other tenants.
The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.
Affected versions:
– Apache CloudStack 4.18.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-59085: Server-Side Request Forgery (SSRF) vulnerability in webhook module
Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack’s webhook module, exploitable via webhook delivery requests.
Affected versions:
– Apache CloudStack 4.20.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-59655: Unauthenticated OAuth provider client-secret disclosure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack’s OAuth authentication plugin while listing OAuth providers.
Affected versions:
– Apache CloudStack 4.19.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-59657: Sensitive Information Disclosure via Cleartext Storage in AsyncJob
Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.
Affected versions:
– Apache CloudStack 4.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-59780: LDAP provider configuration disclosure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack’s LDAP authentication plugin while listing LDAP providers.
Affected versions:
– Apache CloudStack 4.2.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-59799: Missing Privilege Check in Two-Factor Authentication Disable Flow
Improper Privilege Management vulnerability in Apache CloudStack’s Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow.
Affected versions:
– Apache CloudStack 4.18.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-61397: OAuth2 Token Cross-Request Leak
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack’s OAuth2 authentication plugin and Google OAuth integration.
Affected versions:
– Apache CloudStack 4.19.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-61398: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack’s UI while using Instance Reset Password functionality.
Affected versions:
– Apache CloudStack 4.15.1.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-61399: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack’s UI while using Lock User Functionality.
Affected versions:
– Apache CloudStack 4.20.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-61400: Get and Run Diagnostics Command Injection
Improper Neutralization of Special Elements used in a Command (‘Command Injection’) vulnerability in Apache CloudStack’s run and get diagnostics functionality for the system VMs and virtual routers.
An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router.
The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default.
Affected versions:
– Apache CloudStack 4.14.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-61422: Authenticated pre-validation SSRF in registerTemplate
Authenticated pre-validation SSRF vulnerability in Apache CloudStack’s template and ISO registration functionality.
When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Secondary Storage VM.
Affected versions:
– Apache CloudStack 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-62440: Improper access control in Kubernetes Service (CKS) cluster manipulation
Improper Access Control vulnerability in Apache CloudStack’s Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.
Affected versions:
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.22.1.1 or later, which addresses these issues.
CVE-2026-65613: Webhook Deliveries Incorrect Access
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack’s Webhook module while listing and deleting deliveries.
Аffected versions:
– Apache CloudStack 4.20.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-66721: Authorization issue with listHostTags for domain admins
Missing authorization issue for domain admins in CloudStack’s host tags listing functionality.
Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin’s domain.
Affected versions:
– Apache CloudStack 4.12.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-66722: ProjectRole & ProjectRolePermission authorization issue
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack.
A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the target project belongs to their domain or subdomain. This allows a malicious Domain Admin to tamper with project roles and permissions across unrelated domains.
Affected versions:
– Apache CloudStack 4.15.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-66797: Unauthorised comment creation and disclosure
Improper access control in CloudStack’s annotation functionality allows unauthorized comment creation and disclosure.
The addAnnotation and listAnnotation APIs perform an ownership check when an entity’s UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don’t own by simply supplying its UUID.
Affected versions:
– Apache CloudStack 4.16.0.0 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
CVE-2026-68745: SAML2 Signature Validation Silently Skipped for Cert-less IdP
Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures.
Affected versions:
– Apache CloudStack 4.5.2 through 4.20.3.0
– Apache CloudStack 4.21.0.0 through 4.22.1.0
Resolution: Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 or later, which addresses these issues.
Official release notes can be found here: https://docs.cloudstack.apache.org/en/4.22.1.1/releasenotes/index.html
You can download the CloudStack packages here.
Ivet Petrova is the Chief Revenue Officer at ShapeBlue. She is responsible for strengthening ShapeBlue’s global brand and market awareness of ShapeBlue’s services. Specifically, Ivet’s team is responsible for brand, advertising, content and digital marketing, social media, and media relations.
Ivet is also an active member of the CloudStack community, working on increasing the awareness of the technology and showing its benefits to a wider market.
Ivet has 13+ years of experience in marketing for IT service providers including a number of cloud and hosting providers, storage companies, SaaS providers and software development companies. She holds a Masters degree in Marketing.
Away from work, Ivet is passionate about travelling around the world and exploring new cultures.
