EUVD-2026-63837
GHSA-g382-2jw5-f8xr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible API (AV:N, AC:L) requires Admin credentials (PR:H); scope changes to separate system VM/VR instances (S:C) with full root-level code execution impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers.
An authenticated user holding the permissions required to invoke either getDiagnosticsData or runDiagnostics can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router.
The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default.
This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Command injection in Apache CloudStack's diagnostics APIs allows Admin-role authenticated users to execute arbitrary commands as root on system VMs and Virtual Routers, constituting a full compromise of those instances across versions 4.20.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. The getDiagnosticsData and runDiagnostics API endpoints fail to properly neutralize special shell characters in user-supplied input before passing it to underlying diagnostic processes on the target VMs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a CloudStack account with the Admin role, which is the only role authorized by default to call the getDiagnosticsData and runDiagnostics APIs; standard User and Domain Admin accounts without specific delegation cannot invoke these APIs and are not a viable attack vector through this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS score was provided by NVD for this CVE, so risk must be assessed from first principles. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache CloudStack to version 4.20.3.1 (for the 4.20.x track) or 4.22.1.1 (for the 4.21.x/4.22.x track) or later, as confirmed by the vendor advisory at https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Cloudstack
View allCross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes
Two-factor authentication bypass in Apache CloudStack allows an authenticated low-privileged user to exploit an improper
Cross-tenant root command execution in Apache CloudStack (4.14.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0) allows an authenticat
SAML authentication bypass in Apache CloudStack 4.20.3.0 and 4.22.1.0 permits a network-positioned attacker to forge SAM
Authenticated CloudStack users can hijack volumes from other tenants' backups via the Backup plugin in versions 4.21.0.0
Sensitive OAuth configuration data is exposed to unauthenticated remote actors in Apache CloudStack's OAuth authenticati
Sensitive information exposure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration allows u
Missing authorization controls across multiple Userdata-related APIs in Apache CloudStack expose cross-tenant data to an
Broken object-level authorization in Apache CloudStack exposes project role management APIs to Domain Admins operating o
Server-Side Request Forgery in Apache CloudStack's webhook module lets attackers coerce the management server into issui
Resource exhaustion in Apache CloudStack's scoped global configuration subsystem-spanning versions 4.7.0 through 4.20.3.
Improper access control in the CloudStack Backup plugin allows authenticated users in CloudStack 4.21.0.0 through 4.22.0
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today