Apache CloudStack CVE-2026-66797

Exploitation requires a valid authenticated session to the Apache CloudStack API; unauthenticated access is not sufficient. The attacker must supply the UUID of a target entity owned by a different user - UUID knowledge may come from legitimate API responses (entities the attacker can legitimately list) or from enumeration. The vulnerability is triggered via the addAnnotation or listAnnotation API endpoints and applies to all affected CloudStack versions (4.15.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0). Limiting factors: (1) authentication is required, constraining exploitation to internal users or those with stolen API credentials; (2) impact is scoped to the annotation subsystem - not core resource control, storage, or credentials; (3) no default CloudStack configuration exposes annotation data externally.

No CVSS vector was provided by NVD or the vendor, so formal metric comparison is not possible. Based on the description, the attack vector is network-accessible (CloudStack API), complexity is low (supply a known UUID), and exploitation requires authenticated access - a meaningful limiting factor. The impact is confined to the annotation subsystem: unauthorized read of private comments and unauthorized write of false or misleading annotations. This does not expose credentials, configuration data, or enable code execution. No KEV listing and no POC code exists at time of analysis. The overall real-world risk is moderate for multi-tenant CloudStack deployments where annotation data may contain sensitive operational notes, but low for environments where annotations are not used or where the tenant population is fully trusted. The absence of EPSS data means exploitation probability cannot be quantified; the relatively narrow impact scope suggests this is a medium-priority remediation, not an emergency.

An authenticated CloudStack tenant user with minimal privileges obtains the UUID of a VM or account owned by another tenant - possibly through a prior information-disclosure path or educated guessing in a small environment. The attacker calls the listAnnotation API with the target UUID and retrieves private operational notes left by administrators, which may include credentials, maintenance windows, or security posture details. The attacker may then call addAnnotation to insert false comments, potentially manipulating incident response or audit records. No public exploit code has been identified at time of analysis.