Authorization Flaw in Apache CloudStack's Userdata APIs
CVE-2026-50222
Currently unrated
What is CVE-2026-50222?
A significant vulnerability exists in several userdata-related APIs of Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine. These APIs lack sufficient access control validation, which may allow unauthorized cross-tenant or cross-account access to sensitive userdata resources. Additionally, the deleteCniConfiguration API, introduced in version 4.21.0.0, exhibits similar access validation issues. Users are strongly advised to upgrade to versions 4.20.3.1 or 4.22.1.1 or later to mitigate this vulnerability.
Affected Version(s)
Apache CloudStack 4.18.0.0 <= 4.20.3.0
Apache CloudStack 4.21.0.0 <= 4.22.1.0