CVE-2026-47359 Overview
CVE-2026-47359 is an OS command injection vulnerability in the Apache CloudStack NAS backup provider plugin. The addBackupRepository API, available since version 4.20.0.0, and the updateBackupRepository API, introduced in 4.22.0.0, accept unsanitized command options for the backup repository configuration. A malicious operator account can inject arbitrary shell commands into these parameters. The injected commands execute on the KVM hypervisor host when any account subsequently performs a backup restore operation. This flaw affects Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The vulnerability is classified under CWE-78.
Critical Impact
An authenticated operator can achieve arbitrary command execution on KVM hypervisor hosts, compromising the underlying virtualization infrastructure and any hosted workloads.
Affected Products
- Apache CloudStack 4.20.0.0 through 4.20.3.0
- Apache CloudStack 4.21.0.0 through 4.22.1.0
- Deployments using the NAS backup provider plugin with KVM hypervisors
Discovery Timeline
- 2026-08-21 - CVE-2026-47359 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-47359
Vulnerability Analysis
The vulnerability resides in the NAS backup provider plugin within Apache CloudStack. The addBackupRepository and updateBackupRepository APIs accept a command options parameter used to configure how the backup repository is mounted or interacted with on KVM hypervisor hosts. These options are passed downstream without proper neutralization of shell metacharacters. When an authenticated operator submits a malicious payload, CloudStack stores those options as part of the repository definition. The stored payload becomes an active attack vector, executing during a later backup restore operation initiated by any account.
Root Cause
The root cause is the failure to sanitize or safely parameterize user-supplied strings before passing them to an operating system shell on the KVM hypervisor host. The plugin constructs OS commands by concatenating attacker-controllable input directly into command strings. Standard mitigations such as argument list execution (execve-style calls without a shell) or strict allowlist validation are not applied to the affected parameters.
Attack Vector
An attacker requires an operator-level account on the CloudStack management server. Using that account, the attacker calls addBackupRepository or updateBackupRepository with shell metacharacters embedded in the command options field. The malicious payload is persisted with the repository definition. Command execution is triggered when any user, including non-privileged accounts, performs a backup restore that references the poisoned repository. Execution occurs in the context of the CloudStack agent process on the KVM hypervisor host, providing a path to lateral movement across hosted virtual machines.
No verified proof-of-concept code is publicly available. Technical specifics are described in the Apache Mailing List Discussion.
Detection Methods for CVE-2026-47359
Indicators of Compromise
- Backup repository entries containing shell metacharacters such as ;, |, &&, backticks, or $() in the command options field.
- Unexpected child processes spawned by the CloudStack agent on KVM hypervisor hosts during backup restore operations.
- Outbound network connections from KVM hosts to unfamiliar destinations following backup restore activity.
Detection Strategies
- Audit CloudStack API logs for addBackupRepository and updateBackupRepository calls, correlating parameters against a known-good baseline.
- Monitor the CloudStack management database for backup repository records containing suspicious characters in configuration fields.
- Deploy process-execution monitoring on KVM hypervisor hosts to flag shell invocations originating from the CloudStack agent process tree.
Monitoring Recommendations
- Enable verbose auditing on CloudStack management server APIs and forward logs to a centralized SIEM for correlation.
- Alert on backup restore events that immediately precede anomalous process or network activity on KVM hosts.
- Track operator-level account activity, focusing on backup infrastructure changes performed outside change-management windows.
How to Mitigate CVE-2026-47359
Immediate Actions Required
- Upgrade Apache CloudStack to version 4.20.3.1 or 4.22.1.1 or later, which contain the fix.
- Review all existing backup repository definitions for suspicious command option values and remove or recreate any that appear tampered with.
- Rotate credentials for operator-level accounts and audit recent account activity across the CloudStack management plane.
Patch Information
Apache has released fixed versions 4.20.3.1 and 4.22.1.1. Both releases address the improper neutralization of special elements in the NAS backup provider plugin. Refer to the Apache Mailing List Discussion for the official advisory and upgrade guidance.
Workarounds
- Restrict use of the NAS backup provider plugin until upgrades are applied.
- Limit operator-level account assignment to a minimal, audited set of administrators.
- Apply network segmentation between the CloudStack management server, KVM hypervisor hosts, and backup storage to contain potential lateral movement.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
