CVE-2026-50112 Overview
CVE-2026-50112 is a high-severity vulnerability in Apache CloudStack that combines Server-Side Request Forgery (SSRF) with Remote Code Execution (RCE) on KVM hypervisor hosts. An authenticated tenant holding the default User role can register a VM template referencing an attacker-controlled .metalink file. The management server fetches the metalink XML and dispatches the download to the KVM agent without re-validating inner URLs against the scheme allowlist. Exploitation results in cross-tenant root code execution on the underlying compute host, reachable through the public CloudStack API [CWE-78].
Critical Impact
Authenticated tenants can achieve arbitrary shell command execution as root on KVM hypervisors that host other tenants' virtual machines, breaking multi-tenant isolation.
Affected Products
- Apache CloudStack 4.14.0.0 through 4.20.3.0
- Apache CloudStack 4.21.0.0 through 4.22.1.0
- KVM hypervisor hosts and Secondary Storage VMs managed by affected CloudStack versions
Discovery Timeline
- 2026-08-21 - CVE-2026-50112 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-50112
Vulnerability Analysis
The vulnerability exists in the template registration workflow when directDownload=true is combined with a URL pointing to a .metalink file. The CloudStack management server retrieves the metalink XML and delegates the actual download to the KVM agent. The inner mirror URLs embedded in the metalink XML are never re-checked against the scheme allowlist that normally restricts template sources.
This validation gap enables two distinct attack outcomes. First, an SSRF primitive lets an authenticated tenant coerce the Secondary Storage VM to fetch internal resources and persist responses as template files, which are later retrievable through normal APIs. Second, the same parsing flaw permits command injection or unsafe URI handling on the KVM agent, resulting in shell command execution as root on the hypervisor.
Root Cause
The root cause is incomplete input validation. The scheme allowlist is enforced on the outer template URL supplied by the tenant but not re-applied to the inner URLs parsed from the metalink XML document. This inconsistency allows non-allowlisted schemes and internal targets to reach downstream fetchers and agents.
Attack Vector
An authenticated CloudStack user submits a registerTemplate request with directDownload=true pointing to an attacker-controlled .metalink file. The management server retrieves the metalink and forwards inner URLs to the KVM agent. Crafted mirror entries either target internal network addresses (SSRF) or exploit the download path on the KVM host to execute arbitrary commands as root. Technical details are documented in the Apache Mailing List Discussion.
Detection Methods for CVE-2026-50112
Indicators of Compromise
- Template registration events with directDownload=true and URLs ending in .metalink from non-administrative accounts
- Outbound requests from Secondary Storage VMs or KVM agents to internal RFC1918 addresses or localhost endpoints
- Unexpected root-owned processes or shell invocations on KVM hypervisor hosts originating from the CloudStack agent process
- New template files in secondary storage whose contents resemble internal HTTP responses rather than disk images
Detection Strategies
- Audit CloudStack management server logs for registerTemplate API calls that reference .metalink URLs and correlate with tenant identity
- Monitor KVM agent process trees for child processes spawning shells, curl, wget, or scripting interpreters outside normal template import flows
- Inspect network flow telemetry for egress from Secondary Storage VMs to unexpected internal destinations
Monitoring Recommendations
- Enable verbose logging on the CloudStack management server for template lifecycle events and retain logs for forensic review
- Baseline expected download behavior for KVM agents and alert on deviations such as new outbound destinations or command patterns
- Track privilege usage on hypervisor hosts, including sudo and root shell invocations, and correlate with CloudStack API activity
How to Mitigate CVE-2026-50112
Immediate Actions Required
- Upgrade Apache CloudStack to version 4.20.3.1 or 4.22.1.1 or later, which contain the fix
- Restrict the default User role from registering templates with directDownload=true until patching is complete
- Review recently registered templates for suspicious .metalink sources and delete any that cannot be attributed to legitimate operations
Patch Information
Apache CloudStack has released fixed versions 4.20.3.1 and 4.22.1.1. The patches re-validate inner metalink URLs against the scheme allowlist and harden download handling on the KVM agent. Refer to the Apache Mailing List Discussion for the official advisory.
Workarounds
- Disable direct download of templates from tenant accounts by enforcing administrator-only template registration workflows
- Apply network segmentation so Secondary Storage VMs and KVM agents cannot reach sensitive internal management interfaces
- Use egress filtering on hypervisor and storage VMs to restrict downloads to a curated list of trusted mirrors
# Configuration example: verify patched CloudStack version on management server
rpm -qa | grep cloudstack-management
# Expected output includes 4.20.3.1 or 4.22.1.1 or later
# Restrict template registration to admins pending upgrade
cloudmonkey update configuration name=allow.user.direct.download value=false
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
