Apache CloudStack CVE-2026-50222

The attacker must hold a valid Apache CloudStack account (tenant or user) on the same CloudStack instance as the victim. No administrative privilege is required - a standard tenant account suffices. The attacker must be able to supply or enumerate a userdata resource ID belonging to another account; CloudStack resource IDs are UUIDs and not trivially guessable, but may be discoverable through API enumeration, shared templates, or information disclosure in adjacent features. The vulnerability is present in any CloudStack deployment running the affected version ranges without further configuration prerequisites - it is not gated on a non-default feature flag. Exploitation is limited to the CloudStack API surface (typically TCP 8080/8443); operators who restrict API access to internal networks significantly reduce exposure. The deleteCniConfiguration vector additionally requires the 4.21.0.0+ code path.

The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) warrants scrutiny: the PR:N (no privileges required) rating conflicts with the description, which frames the vulnerability as cross-tenant access - implying the attacker holds a valid CloudStack account in the same or a different tenant. A truly unauthenticated exploitation path is not described and would be unusual for CloudStack API endpoints. The I:N (no integrity impact) rating also appears incomplete given that deleteUserData and resetUserDataForVirtualMachine can modify or destroy another tenant's resources. EPSS at 0.13% (3rd percentile) is low, consistent with no public exploit and no KEV listing, suggesting opportunistic mass exploitation is not currently occurring. Real-world risk is highest for multi-tenant managed cloud providers where tenant isolation is a contractual and regulatory obligation; in those environments even a single cross-tenant read of userdata may expose cloud-init secrets or API keys with broad downstream blast radius. Single-tenant private deployments face materially lower risk. No public exploit has been identified at time of analysis.

An authenticated CloudStack tenant enumerates or guesses userdata resource IDs belonging to a different tenant - IDs are often sequential or derivable - then calls the deleteUserData or linkUserDataToTemplate API specifying the victim's resource ID. Because no ownership check is performed, the platform processes the request, allowing the attacker to read cloud-init payloads (potentially containing secrets or SSH keys) or destroy the victim tenant's userdata, disrupting VM provisioning. No public proof-of-concept code has been identified at time of analysis.