Authorization Flaw in Apache CloudStack Affects Domain Admins

CVE-2026-66721

What is CVE-2026-66721?

A missing authorization vulnerability in Apache CloudStack allows domain admins to access host tags across the entire environment without domain restrictions. The listHostTags API, which is typically scoped to individual domains, fails to enforce this limitation, potentially exposing sensitive data related to hosts outside of the admin's domain. Affected users should upgrade to version 4.20.3.1 or 4.22.1.1 or later to mitigate this issue.

References