EUVD-2026-63835
GHSA-2vq4-5w2v-frrg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Cross-tenant action requires a valid tenant account (PR:L) and crosses a security boundary (S:C); removing nodes degrades a victim cluster, so A:H rather than the vendor's A:N.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.
This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Cross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes on Kubernetes clusters belonging to other tenants, affecting versions 4.21.0.0 through 4.22.1.0. The improper access control breaks tenant isolation in a multi-tenant IaaS platform, enabling unauthorized integrity and confidentiality impact against neighboring tenants' clusters. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a CloudStack deployment running the Kubernetes Service (CKS) plugin in a multi-tenant configuration, and the attacker must be able to issue CKS node add/remove operations - realistically meaning they hold a valid tenant/account on the target CloudStack instance (the 'cross-tenant' framing implies at least tenant-level access even though the vendor vector states PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and warrant judgment rather than blind reliance on the 9.1 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Apache CloudStack to version 4.22.1.1 or later, which fixes the access-control flaw, per the Apache advisory at https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Apache CloudStack deployments, determine if versions 4.21.0.0 through 4.22.1.0 are running, and check whether Kubernetes Service plugin is enabled in production; disable the plugin if operationally feasible and not critical to business operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today