CVE-2026-62440: Apache CloudStack Privilege Escalation Flaw

CVE-2026-62440 Overview

CVE-2026-62440 is an Improper Access Control vulnerability [CWE-284] in the Apache CloudStack Kubernetes Service (CKS) plugin. The flaw allows cross-tenant manipulation of Kubernetes clusters when adding or removing nodes. Authenticated users in one tenant can affect Kubernetes clusters owned by other tenants, breaking the isolation boundary that multi-tenant cloud platforms depend on.

The vulnerability affects Apache CloudStack versions 4.21.0.0 through 4.22.1.0. The Apache CloudStack project has released version 4.22.1.1 to remediate the issue.

Critical Impact
Attackers with network access can manipulate Kubernetes clusters across tenant boundaries, compromising confidentiality and integrity of workloads managed by the CKS plugin.

Affected Products

Apache CloudStack 4.21.0.0
Apache CloudStack 4.22.0.0
Apache CloudStack 4.22.1.0

Discovery Timeline

2026-08-21 - CVE-2026-62440 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-62440

Vulnerability Analysis

Apache CloudStack is an open-source Infrastructure-as-a-Service (IaaS) platform that manages compute, network, and storage resources for multi-tenant clouds. The CloudStack Kubernetes Service (CKS) plugin provisions and manages Kubernetes clusters as a tenant-scoped resource.

The vulnerability resides in the authorization logic that governs node lifecycle operations on CKS-managed clusters. When a user requests to add or remove a node from a Kubernetes cluster, the plugin fails to fully validate that the caller owns the target cluster. An authenticated user in one account can therefore issue node add or remove operations against clusters belonging to a different tenant.

The impact includes unauthorized scaling of foreign clusters, disruption of workloads through node removal, and potential injection of attacker-controlled nodes into another tenant's control plane. This breaks the tenant isolation model that CloudStack operators rely on for multi-customer deployments.

Root Cause

The root cause is missing or incomplete ownership checks in the CKS plugin's node management API paths. The authorization layer verifies that the caller is authenticated but does not consistently enforce that the target cluster and its associated resources belong to the caller's account or domain, aligning with the [CWE-284] Improper Access Control pattern.

Attack Vector

Exploitation requires network access to the CloudStack management API and valid credentials for any tenant on the target deployment. The attacker calls CKS node management endpoints while referencing a cluster identifier owned by another tenant. No user interaction is required. Because CKS operations touch compute and networking resources, successful exploitation can cascade to the underlying hypervisor and network layers managed by CloudStack.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Apache Mailing List Discussion for the vendor advisory.

Detection Methods for CVE-2026-62440

Indicators of Compromise

CloudStack API audit log entries showing addNodesToKubernetesCluster or removeNodesFromKubernetesCluster calls where the caller's account differs from the owning account of the referenced cluster.
Unexpected changes in Kubernetes cluster node counts that do not correlate with legitimate tenant activity.
New virtual machines joining CKS clusters from source accounts that do not own the target cluster.

Detection Strategies

Correlate CloudStack management server audit logs against the tenant ownership database to identify cross-account CKS API calls.
Alert on any CKS node lifecycle API invocation where the account or domainid parameter does not match the caller's session context.
Baseline normal CKS scaling patterns per tenant and flag deviations, particularly outside change windows.

Monitoring Recommendations

Ship CloudStack management server logs and API audit trails into a centralized SIEM for correlation and long-term retention.
Monitor Kubernetes cluster events (kubectl get events) on CKS-managed clusters for unexpected node join or removal events.
Track hypervisor-level provisioning events tied to CKS templates to detect nodes being created against foreign tenant clusters.

How to Mitigate CVE-2026-62440

Immediate Actions Required

Upgrade Apache CloudStack to version 4.22.1.1 or later on all management servers.
Audit CKS API activity retroactively for cross-tenant node add or remove operations since deployment of an affected version.
Rotate credentials and API keys for any tenant accounts suspected of misuse during the exposure window.
Review Kubernetes cluster membership on CKS-managed clusters and remove any nodes that cannot be attributed to legitimate scaling actions.

Patch Information

The Apache CloudStack project fixed CVE-2026-62440 in version 4.22.1.1. Operators running versions from 4.21.0.0 through 4.22.1.0 must upgrade to receive the corrected authorization checks. Refer to the Apache Mailing List Discussion for release details.

Workarounds

If immediate patching is not possible, disable the CKS plugin on the management server until the upgrade can be completed.
Restrict CloudStack API access to trusted management networks and enforce per-tenant network segmentation.
Temporarily revoke CKS-related privileges from non-administrative roles by adjusting the CloudStack RBAC configuration.

bash

# Verify the running CloudStack management server version
cloudstack-sccs --version

# Confirm target version after upgrade (expected: 4.22.1.1 or later)
rpm -q cloudstack-management

# Optional: disable the CKS plugin until patched
# Edit /etc/cloudstack/management/server.properties and set:
#   cloud.kubernetes.service.enabled=false
systemctl restart cloudstack-management