CVE-2025-59454: Apache CloudStack Access Control Flaw

CVE-2025-59454 is an information disclosure vulnerability in Apache CloudStack caused by insufficient access control checks in multiple APIs. Authorized users could access data beyond their intended scope. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2025-59454 Overview

Apache CloudStack contains an access control weakness affecting five administrative APIs: createNetworkACL, listNetworkACLs, listResourceDetails, listVirtualMachinesUsageHistory, and listVolumesUsageHistory. Insufficient permission validation allows authenticated users to occasionally access information beyond their intended scope. The flaw is categorized as an information exposure issue [CWE-200] and requires low-privilege authentication over the network. Apache has released fixed versions to address the gap.

Critical Impact
Authenticated CloudStack users may retrieve network ACL entries, resource details, and virtual machine or volume usage history belonging to other tenants or scopes they should not access.

Affected Products

Apache CloudStack versions prior to 4.20.2.0
Apache CloudStack 4.21.0.0
Apache CloudStack versions prior to 4.22.0.0

Discovery Timeline

2025-11-27 - CVE-2025-59454 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59454

Vulnerability Analysis

The vulnerability resides in the permission validation logic of five Apache CloudStack management APIs. Each API enforces authentication but fails to consistently validate whether the requesting user has authorization for the specific resource being queried or created. This is a broken access control issue mapped to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

The affected endpoints include createNetworkACL for creating network access control lists, listNetworkACLs for enumerating them, listResourceDetails for metadata retrieval, and the listVirtualMachinesUsageHistory and listVolumesUsageHistory APIs for reading VM and storage usage data. In multi-tenant CloudStack deployments, this may expose one tenant's operational data to another authenticated tenant.

Exploitation requires only valid CloudStack account credentials. Attackers can invoke the vulnerable APIs through the standard CloudStack management interface and receive data outside their authorized scope. No user interaction is required beyond the standard API request.

Root Cause

The root cause is insufficient permission validation within the API handlers. While each endpoint enforces that the caller is authenticated, the authorization layer does not always verify that the target resource belongs to the caller's account, domain, or project scope before returning data.

Attack Vector

An authenticated attacker sends crafted API requests to the CloudStack management server using their existing session or API key. By supplying identifiers or filter parameters, the attacker can trigger the flawed permission check and receive resource data belonging to other users. The attack is fully remote and requires no elevated privileges.

See the Apache Mailing List Discussion and the Openwall OSS Security Update for the official advisory text.

Detection Methods for CVE-2025-59454

Indicators of Compromise

Unexpected API calls to listNetworkACLs, listResourceDetails, listVirtualMachinesUsageHistory, or listVolumesUsageHistory from user accounts that historically do not query these endpoints.
Requests to createNetworkACL originating from non-administrative accounts or from accounts outside the network's owning domain.
Spikes in API response sizes for the affected endpoints, indicating cross-tenant data returned in a single call.

Detection Strategies

Enable CloudStack management server API auditing and review logs for the five affected API names correlated with the requesting account and target resource ID.
Baseline normal API usage per account and alert on deviations, particularly access to resources outside the caller's domain or project.
Correlate CloudStack API logs with tenant ownership metadata to identify cross-tenant reads.

Monitoring Recommendations

Forward CloudStack management server logs to a centralized SIEM for retention and correlation.
Monitor authentication events and API key usage for accounts making unusual queries against the affected endpoints.
Track version information for all CloudStack management servers to confirm patched builds are deployed.

How to Mitigate CVE-2025-59454

Immediate Actions Required

Upgrade Apache CloudStack to version 4.20.2.0 or 4.22.0.0, both of which contain the fix.
Inventory all CloudStack management servers and identify any running 4.21.0.0 or earlier vulnerable releases.
Review recent API access logs for the five affected endpoints to identify potential prior exposure.

Patch Information

Apache has released Apache CloudStack 4.20.2.0 and 4.22.0.0 to remediate the access control gap. Refer to the Apache Mailing List Discussion for release details and upgrade guidance.

Workarounds

No official workaround is documented; upgrading to a fixed release is the recommended remediation.
Restrict CloudStack management API access to trusted network segments and enforce least-privilege account provisioning as a compensating control.
Rotate API keys for any accounts suspected of unauthorized access and revoke keys that are no longer required.

bash

# Verify CloudStack management server version
cloudstack-sccs --version
# Expected output for patched systems: 4.20.2.0 or 4.22.0.0