Apache CloudStack CVE-2026-50112

Requires a valid authenticated CloudStack account with the default User role and access to the public CloudStack API - no admin rights are needed. The concrete prerequisite is the directDownload template-registration feature: the attacker registers a template with directDownload=true and a URL pointing to an attacker-controlled .metalink file, whose inner mirror URLs are never re-validated against the scheme allowlist. The RCE targets deployments using the KVM hypervisor; the SSRF variant exercises the Secondary Storage VM's retrieval of the metalink targets. Limiting factors: exploitation is confined to CloudStack versions 4.14.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0 running KVM with the direct-download/metalink path reachable, and the attacker must be able to host or point to a crafted metalink file; environments that disable direct-download template registration or do not use KVM are not exploitable via this exact chain.

This is a genuine high-priority issue rather than a high-CVSS-but-low-impact finding: the attacker only needs the default User role reachable through the public CloudStack API, and the outcome is arbitrary root command execution on the shared KVM host that runs other tenants' workloads - a full breach of tenant isolation on the compute plane. No vendor CVSS is supplied, but an independent assessment places this near the top of the scale (scope-changed, high C/I/A, low privilege) because a low-privileged tenant escalates to cross-tenant root. There is no CISA KEV listing and no public proof-of-concept identified at time of analysis, and EPSS is unavailable, so exploitation is not confirmed in the wild; however, the low barrier to entry (any tenant account) and severe impact mean any multi-tenant CloudStack operator running KVM should treat patching as urgent and not wait for a public exploit to appear. The SSRF variant compounds the risk by exposing internal-only targets as retrievable template files.

A malicious customer signs up for or compromises an ordinary tenant account (default User role) on a multi-tenant CloudStack cloud and registers a VM template with directDownload=true pointing to an attacker-hosted .metalink file whose inner URLs carry a command-injection payload. When the management server parses the Metalink and dispatches the download to the KVM agent, the unvalidated URL is executed in a shell context, running attacker commands as root on the hypervisor that hosts other tenants' VMs. No public POC is currently known, but the attack requires only a valid tenant account and the public API.