CVE-2026-25077: Apache CloudStack RCE Vulnerability

CVE-2026-25077 Overview

CVE-2026-25077 affects Apache CloudStack deployments using the Kernel-based Virtual Machine (KVM) hypervisor. Account users can register templates that download directly to primary storage for instance deployment. The platform fails to sanitize file names during this process, allowing attackers to register malicious templates that execute arbitrary code on KVM hosts. Successful exploitation compromises resource integrity and confidentiality, causes data loss, and disrupts availability of the KVM-based infrastructure managed by CloudStack. The flaw is classified under [CWE-94] Improper Control of Generation of Code (Code Injection).

Critical Impact

An authenticated low-privilege account user can execute arbitrary code on KVM hosts, leading to full compromise of the underlying virtualization infrastructure.

Affected Products

• Apache CloudStack versions prior to 4.20.3.0
• Apache CloudStack 4.21.x and 4.22.x prior to 4.22.0.1
• KVM hypervisor hosts managed by vulnerable CloudStack deployments

Discovery Timeline

• 2026-05-08 - CVE-2026-25077 published to NVD
• 2026-05-10 - Last updated in NVD database

Technical Details for CVE-2026-25077

Vulnerability Analysis

Apache CloudStack allows account-level users to register virtual machine templates that download directly into primary storage for KVM-based instance deployment. This default behavior assumes template metadata, including the file name, can be trusted. The platform does not sanitize the template file name before it is consumed by downstream processes on the KVM host. An authenticated user can craft a template registration request with a file name that contains shell metacharacters or command sequences. When the KVM host processes the registration and stages the file, the unsanitized name is interpreted as part of an executable context, resulting in arbitrary code execution on the hypervisor host.

Root Cause

The root cause is missing input validation on the template file name during registration. CloudStack accepts the user-supplied value and passes it to KVM host operations without enforcing an allowlist of safe characters or escaping shell-significant tokens. This is a code injection flaw consistent with [CWE-94].

Attack Vector

The attack is performed over the network through the CloudStack management API. The attacker requires a valid low-privileged account on the CloudStack deployment. No user interaction is required. Once a malicious template is registered and processed, code executes in the security context of the KVM host service, enabling lateral movement across the virtualization fabric, theft of tenant data, and disruption of hosted workloads.

No verified public exploit code is available for CVE-2026-25077. Refer to the Apache Mailing List Thread and the OpenWall OSS Security Post for the vendor's technical description.

Detection Methods for CVE-2026-25077

Indicators of Compromise

• Template registration API calls (registerTemplate) containing shell metacharacters, backticks, semicolons, or command substitution sequences in the template name or URL fields.
• Unexpected child processes spawned by the cloudstack-agent or libvirtd service on KVM hosts.
• New or modified files in KVM primary storage directories with anomalous names or timestamps that do not match standard template UUID patterns.
• Outbound network connections from KVM hosts to attacker-controlled infrastructure following a template registration event.

Detection Strategies

• Audit CloudStack management server logs for registerTemplate events and correlate template names against a strict allowlist of alphanumeric characters, dashes, and dots.
• Monitor KVM hosts for process executions whose parent is the CloudStack agent and whose command line includes shell operators.
• Implement file integrity monitoring on primary storage mount points and /usr/share/cloudstack-* directories on KVM hosts.

Monitoring Recommendations

• Forward CloudStack API audit logs and KVM host process telemetry to a centralized analytics platform for correlation.
• Alert on any non-administrative account performing template registrations outside of approved change windows.
• Track outbound DNS and HTTP traffic from KVM hosts and baseline normal patterns to flag deviations.

How to Mitigate CVE-2026-25077

Immediate Actions Required

• Upgrade Apache CloudStack to version 4.20.3.0, 4.22.0.1, or later as published by the Apache CloudStack project.
• Inventory all CloudStack accounts and revoke template registration permissions for users that do not require them.
• Review recent template registration activity for suspicious file names or URLs and quarantine affected KVM hosts pending forensic review.

Patch Information

Apache has released fixed versions 4.20.3.0 and 4.22.0.1 that implement file name sanitization for template registration. Patch details are published in the Apache Mailing List Thread. Administrators should apply the upgrade following the standard CloudStack management server and agent update procedure, then verify both management server and KVM agent versions on every host.

Workarounds

• Disable direct template download to primary storage by restricting the direct.download configuration option where operationally feasible.
• Restrict template registration to administrator roles using CloudStack's role-based access control until the upgrade is applied.
• Network-segment KVM hosts so they cannot initiate outbound connections to arbitrary internet destinations during template staging.

# Example: restrict template registration to admin roles via CloudMonkey
cloudmonkey update role id=<USER_ROLE_ID> \
    rules='[{"rule":"registerTemplate","permission":"deny"}]'

# Verify CloudStack management server version
rpm -qa | grep cloudstack-management
# Expected: cloudstack-management-4.20.3.0 or 4.22.0.1 or later