Apache Cloudstack

Resource exhaustion in Apache CloudStack's scoped global configuration subsystem-spanning versions 4.7.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0-allows authenticated low-privilege users to gradually trigger a denial-of-service condition against the management server. The vulnerability (CWE-772) affects multiple plugins including Quota and Host-HA, which allocate resources during configuration operations but fail to release them after their effective lifetime. No public exploit or active exploitation has been identified; vendor-released fixes are available in 4.20.3.1 and 4.22.1.1.

OS command injection in Apache CloudStack's NAS backup provider plugin enables an authenticated operator account to execute arbitrary commands on KVM hypervisor hosts by supplying unsanitized shell metacharacters to the addBackupRepository or updateBackupRepository management APIs. Affected deployments span versions 4.20.0.0 through 4.22.1.0 when the NAS backup provider plugin is in use; exploitation is deferred and triggered when any downstream account performs a backup restore. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as 'none,' though technical impact is rated 'total' given hypervisor-level code execution.

Cross-tenant root command execution in Apache CloudStack (4.14.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0) allows an authenticated tenant holding only the default User role to run arbitrary shell commands as root on the KVM hypervisor host, which also runs other tenants' VMs. The flaw stems from CloudStack fetching a user-supplied .metalink file during directDownload template registration and dispatching its inner URLs to the KVM agent without re-validating them against the scheme allowlist; a related SSRF variant lets the Secondary Storage VM retrieve internal targets and persist them as downloadable templates. No public exploit identified at time of analysis, and no CVSS is provided by the vendor.

Missing authorization controls across multiple Userdata-related APIs in Apache CloudStack expose cross-tenant data to any authenticated CloudStack user. Affected APIs - deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, updateVirtualMachine, and (from 4.21.0.0) deleteCniConfiguration - fail to validate that the requesting account owns the target userdata resource, enabling one tenant to read, delete, or manipulate another tenant's userdata. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.13% at the 3rd percentile indicates low automated exploitation activity to date, though the multi-tenant cloud infrastructure context makes successful exploitation high-impact for affected operators.

Server-Side Request Forgery in Apache CloudStack's webhook module lets attackers coerce the management server into issuing arbitrary HTTP requests via webhook delivery, reaching internal-only services and cloud metadata endpoints that are otherwise unreachable from outside. It affects Apache CloudStack 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, carries a CVSS 9.1 (high confidentiality and integrity impact), and has no public exploit identified at time of analysis. EPSS is low at 0.14% (4th percentile) and it is not on CISA KEV, indicating no observed active exploitation yet.

Sensitive OAuth configuration data is exposed to unauthenticated remote actors in Apache CloudStack's OAuth authentication plugin when the OAuth provider listing endpoint is queried. Affected versions span two release branches: 4.19.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. Despite a CVSS score of 7.5 reflecting unauthenticated network access and high confidentiality impact, EPSS sits at just 0.17% (7th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis, suggesting limited active exploitation to date.

Cleartext storage of sensitive information in Apache CloudStack's AsyncJob database records exposes credentials and operation-sensitive data to any party with read access to the underlying database. All CloudStack deployments from version 4.0.0 through 4.22.1.0 are affected across both the 4.x stable and 4.21/4.22 release lines. No public exploit code has been identified and EPSS sits at the 1st percentile, but the NVD-assigned confidentiality impact of HIGH reflects that AsyncJob records may capture sensitive payloads - such as API secrets or passwords - passed through asynchronous operations, stored durably in cleartext rather than encrypted at rest.

Unauthorized LDAP configuration disclosure in Apache CloudStack exposes LDAP server details - including bind credentials and hostnames - to any authenticated user via the listLdapConfigurations API, which is accessible to all default CloudStack roles. Affected versions span 4.2.0.0 through 4.22.1.0, a broad range suggesting long-standing exposure in enterprise and cloud provider deployments. No public exploit code has been identified at time of analysis, but the low barrier of a valid account and the downstream risk of harvested LDAP bind credentials elevate practical severity beyond the EPSS score suggests.

Two-factor authentication bypass in Apache CloudStack allows an authenticated low-privileged user to exploit an improper privilege management flaw in the 2FA plugin's disable flow, effectively circumventing the second authentication factor. Affected deployments span versions 4.18.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, with vendor-confirmed fixes in 4.20.3.1 and 4.22.1.1. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), indicating low observed exploitation pressure despite the high vendor-assigned CVSS of 8.8.

Sensitive information exposure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration allows unauthenticated remote attackers to access high-confidentiality data across two affected version ranges. The flaw is network-reachable with no authentication or user interaction required (CVSS AV:N/AC:L/PR:N/UI:N), making it a genuine High-severity finding for any CloudStack deployment with OAuth2 or Google OAuth enabled. EPSS sits at 0.17% (7th percentile) and no CISA KEV listing exists, suggesting no public exploitation activity at time of analysis; however, the low attack complexity and zero privilege requirement keep real-world risk elevated for affected configurations.

Improper output encoding in the Apache CloudStack management UI's Instance Reset Password feature allows injection of unescaped output that can expose sensitive data or manipulate the interface. It affects Apache CloudStack 4.15.1.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, an open-source IaaS cloud orchestration platform. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile); vendor-released patches exist in 4.20.3.1 and 4.22.1.1.

Improper output encoding in Apache CloudStack's management UI exposes administrators to cross-site scripting (XSS) when using the Lock User functionality across versions 4.20.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. A low-privilege user can embed a malicious script payload in a user-controlled field; when an administrator invokes the Lock User workflow, the CloudStack UI renders the payload without proper HTML or JavaScript escaping, executing it in the admin's browser session. No public exploit or CISA KEV listing has been identified at time of analysis, but the potential for admin session hijacking makes this a meaningful risk in multi-tenant environments.

Command injection in Apache CloudStack's diagnostics APIs allows Admin-role authenticated users to execute arbitrary commands as root on system VMs and Virtual Routers, constituting a full compromise of those instances across versions 4.20.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. The getDiagnosticsData and runDiagnostics API endpoints fail to properly neutralize special shell characters in user-supplied input before passing it to underlying diagnostic processes on the target VMs. No public exploit code or CISA KEV listing has been identified at time of analysis, but successful exploitation of a Virtual Router can expose all guest network traffic routed through that instance and provide a lateral movement foothold within the CloudStack-managed infrastructure.

Pre-validation SSRF in Apache CloudStack's template and ISO registration allows authenticated users to trigger HTTP HEAD/GET requests to arbitrary URLs - including internal network resources - before URL validation is applied. Affected versions are 4.20.3.0 and 4.21.0.0 through 4.22.1.0; vendor-released patches exist in 4.20.3.1 and 4.22.1.1. No public exploit code or active exploitation has been identified at time of analysis, and exploitation requires valid CloudStack credentials with template-registration privileges.

Cross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes on Kubernetes clusters belonging to other tenants, affecting versions 4.21.0.0 through 4.22.1.0. The improper access control breaks tenant isolation in a multi-tenant IaaS platform, enabling unauthorized integrity and confidentiality impact against neighboring tenants' clusters. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile) despite the 9.1 CVSS.

Sensitive information exposure in Apache CloudStack's Webhook module allows unauthorized actors to view data they should not have access to during webhook delivery listing and deletion operations. Affected deployments span versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, covering two active release trains. No public exploit or active exploitation has been identified at time of analysis; vendor-released patches are available.

Missing authorization in Apache CloudStack's listHostTags API allows domain administrators to enumerate host tags across all domains in a multi-tenant deployment, violating tenant isolation boundaries established by the domain hierarchy. Affected versions span 4.12.0.0 through 4.22.1.0 across two release trains, with vendor-released patches in 4.20.3.1 and 4.22.1.1 confirmed by the Apache security advisory. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is meaningful in shared, multi-tenant CloudStack environments where cross-domain host tag visibility undermines infrastructure confidentiality guarantees between tenants.

Broken object-level authorization in Apache CloudStack exposes project role management APIs to Domain Admins operating outside their assigned domain scope. Authenticated Domain Admins can create, update, delete, and enumerate project roles and role permissions for projects belonging to entirely unrelated domains, because the authorization check validates only that the caller holds the Domain Admin role without confirming the target project falls within their domain or any subdomain hierarchy. Affected versions span 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0; no public exploit has been identified at time of analysis and EPSS probability is very low at 0.13%.

Improper access control in Apache CloudStack's annotation APIs (addAnnotation and listAnnotation) allows any authenticated user to read and write annotations on entities they do not own. The APIs perform an ownership check when an entity UUID is supplied but fail to enforce the result of that check, reducing authorization to a formality that any authenticated user can bypass. No public exploit has been identified at time of analysis; no EPSS or CISA KEV data is available, but the bug affects all CloudStack deployments from 4.15.0.0 onward until the patched releases.

SAML authentication bypass in Apache CloudStack 4.20.3.0 and 4.22.1.0 permits a network-positioned attacker to forge SAML responses and authenticate as any user against the management server without valid credentials. The flaw stems from improper cryptographic signature verification (CWE-347): the management server fails to validate SAML response certificates, so a forged assertion passes unchecked. Exploitation requires either spoofing the IdP's IP address or registering a controlled URL as a trusted IdP endpoint in the management server - conditions that raise the practical bar but, if met, yield full administrative access. No public exploit or CISA KEV listing has been identified; the EPSS score of 0.07% reflects minimal observed exploitation at time of analysis.

Authenticated CloudStack users can hijack volumes from other tenants' backups via the Backup plugin in versions 4.21.0.0 and 4.22.0.0. Attackers with low-privileged authenticated access can restore any user's backup volume and attach it to their own VMs, enabling complete data theft across tenant boundaries in multi-tenant environments. CVSS 8.1 reflects high confidentiality and integrity impact with low attack complexity. EPSS score of 0.01% indicates minimal observed exploitation activity, while SSVC assessment confirms non-automatable, partial technical impact with no known exploitation. Apache released patch version 4.22.0.1 addressing the access control flaw.

Improper access control in the CloudStack Backup plugin allows authenticated users in CloudStack 4.21.0.0 through 4.22.0.0 to create new virtual machines using backups belonging to other users, enabling unauthorized data access and VM provisioning. The vulnerability requires valid CloudStack credentials and access to specific backup-related APIs but carries elevated risk in multi-tenant environments. Vendor-released patch available in CloudStack 4.22.0.1.

Improper authorization logic in the CloudStack Backup plugin allows authenticated users to enumerate backups from any account in the environment across versions 4.21.0.0 through 4.22.0.0. An attacker with valid user credentials can exploit this to gain unauthorized visibility into backup metadata and existence across all accounts, though backup contents remain protected. The vulnerability requires the Backup plugin to be enabled and affects multi-tenant CloudStack environments where account isolation is a critical security boundary.