EUVD-2026-63846
GHSA-h5gh-c77h-9ppf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
PR:L reflects that a valid CloudStack account is required; I:L added because delete and reset APIs cause integrity impact on victim tenant resources.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.
Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.
This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Missing authorization controls across multiple Userdata-related APIs in Apache CloudStack expose cross-tenant data to any authenticated CloudStack user. Affected APIs - deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, updateVirtualMachine, and (from 4.21.0.0) deleteCniConfiguration - fail to validate that the requesting account owns the target userdata resource, enabling one tenant to read, delete, or manipulate another tenant's userdata. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid Apache CloudStack account (tenant or user) on the same CloudStack instance as the victim. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) warrants scrutiny: the PR:N (no privileges required) rating conflicts with the description, which frames the vulnerability as cross-tenant access - implying the attacker holds a valid CloudStack account in the same or a different tenant. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache CloudStack 4.20.3.1 (for the 4.18-4.20 branch) or 4.22.1.1 (for the 4.21-4.22 branch) or any later release, which the vendor confirms resolves the authorization deficiency across all affected APIs. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: determine if your organization operates affected CloudStack versions (pre-patched releases; contact vendor to confirm exact version ranges) and assess the scope of multi-tenant user access; immediately notify infrastructure and security teams of the authorization bypass. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Cloudstack
View allCross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes
Unauthorized cross-tenant access in Apache CloudStack 4.21.0 through 4.22.0 allows remote unauthenticated attackers to g
Two-factor authentication bypass in Apache CloudStack allows an authenticated low-privileged user to exploit an improper
Cross-tenant root command execution in Apache CloudStack (4.14.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0) allows an authenticat
Remote code execution in Apache CloudStack allows authenticated account users to execute arbitrary code on KVM hyperviso
SAML authentication bypass in Apache CloudStack 4.20.3.0 and 4.22.1.0 permits a network-positioned attacker to forge SAM
Authenticated CloudStack users can hijack volumes from other tenants' backups via the Backup plugin in versions 4.21.0.0
Apache CloudStack's MinIO integration fails to clean up bucket access policies when buckets are deleted, enabling previo
Sensitive OAuth configuration data is exposed to unauthenticated remote actors in Apache CloudStack's OAuth authenticati
Sensitive information exposure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration allows u
Broken object-level authorization in Apache CloudStack exposes project role management APIs to Domain Admins operating o
Server-Side Request Forgery in Apache CloudStack's webhook module lets attackers coerce the management server into issui
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today