Authorization Flaw in Apache CloudStack Affects Domain Admins
CVE-2026-66721

2.7LOW

Key Information:

Vendor

Apache
Status
Apache Cloudstack
Vendor
CVE Published:
21 August 2026

What is CVE-2026-66721?

A missing authorization vulnerability in Apache CloudStack allows domain admins to access host tags across the entire environment without domain restrictions. The listHostTags API, which is typically scoped to individual domains, fails to enforce this limitation, potentially exposing sensitive data related to hosts outside of the admin's domain. Affected users should upgrade to version 4.20.3.1 or 4.22.1.1 or later to mitigate this issue.

Affected Version(s)

Apache CloudStack 4.12.0.0 <= 4.20.3.0

Apache CloudStack 4.21.0.0 <= 4.22.1.0

References

https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3f...
vendor-advisory

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

KQ Wu <kqmailbox@163.com>
.