CVE-2026-66721: Apache CloudStack Auth Bypass Vulnerability

CVE-2026-66721 Overview

CVE-2026-66721 is a missing authorization vulnerability [CWE-862] in Apache CloudStack's listHostTags API. Domain administrators can invoke this API by default, but the response returns host tags for every host in the environment. The API fails to apply domain scoping, so results are not restricted to hosts dedicated to the calling admin's domain. This exposes infrastructure metadata across tenant boundaries in multi-tenant CloudStack deployments. The issue affects Apache CloudStack from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Fixed releases are 4.20.3.1 and 4.22.1.1.

Critical Impact
Domain admins can enumerate host tags across the entire CloudStack environment, breaking tenant isolation and leaking infrastructure topology.

Affected Products

Apache CloudStack 4.12.0.0 through 4.20.3.0
Apache CloudStack 4.21.0.0 through 4.22.1.0
Fixed in Apache CloudStack 4.20.3.1 and 4.22.1.1

Discovery Timeline

2026-08-21 - CVE-2026-66721 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-66721

Vulnerability Analysis

Apache CloudStack exposes the listHostTags API to allow administrators to query tags assigned to hypervisor hosts. Host tags are used for host allocation decisions, host isolation, and workload placement. In a properly scoped multi-tenant deployment, a domain administrator should only see resources dedicated to their domain.

The vulnerable implementation checks that the caller has permission to invoke listHostTags but does not filter the returned records by the caller's domain. As a result, a domain admin receives host tags for every host in the environment, including hosts dedicated to other domains and hosts in the ROOT scope.

The disclosed information can reveal hypervisor naming conventions, cluster segmentation, dedicated-host relationships, and internal tenant identifiers embedded in tag values. Attackers use this data to plan lateral movement or to correlate tenants with dedicated infrastructure.

Root Cause

The defect is a missing authorization control [CWE-862] in the query path backing listHostTags. Role-based entry checks confirm the caller is allowed to call the API, but the SQL query and response builder omit the domain-scoping predicate applied to other host-related list APIs. Domain filtering must be enforced at data retrieval, not only at API entry.

Attack Vector

Exploitation requires network access to the CloudStack management server API and valid domain-admin credentials. An authenticated domain admin issues a standard listHostTags request over the CloudStack API. The server returns tags for all hosts regardless of domain membership. No special tooling or crafted payload is needed. See the Apache Mailing List Discussion for the vendor advisory.

Detection Methods for CVE-2026-66721

Indicators of Compromise

Repeated listHostTags API calls originating from domain-admin accounts that do not typically query infrastructure inventory.
API access log entries showing command=listHostTags from non-ROOT admin sessions.
Unusual volume of host-tag enumeration correlated with subsequent reconnaissance of dedicated hosts.

Detection Strategies

Audit CloudStack management-server API logs for listHostTags invocations and cross-reference caller domain against returned host domains.
Alert on domain-admin sessions that access APIs outside a documented baseline for that role.
Review CloudStack usage records and event tables for enumeration patterns preceding tenant-boundary probing.

Monitoring Recommendations

Forward CloudStack management-server access logs and audit events to a centralized log platform for correlation.
Baseline expected listHostTags callers and generate alerts when new principals invoke the API.
Track version metadata on CloudStack management servers to confirm patched releases are deployed across the fleet.

How to Mitigate CVE-2026-66721

Immediate Actions Required

Upgrade Apache CloudStack management servers to version 4.20.3.1 or 4.22.1.1 or later.
Review the roster of accounts holding the Domain Admin role and remove unnecessary assignments.
Audit historical API logs for prior listHostTags calls by domain admins to assess information exposure.

Patch Information

Apache has released fixed versions 4.20.3.1 and 4.22.1.1 that add domain scoping to the listHostTags API. Refer to the Apache Mailing List Discussion for release notes and upgrade guidance.

Workarounds

Restrict Domain Admin role assignments to trusted operators until the upgrade is complete.
Use CloudStack's role-based access control to create a custom role that denies listHostTags for domain-scoped administrators.
Restrict management-server API access to trusted networks and administrative jump hosts.

bash

# Example: disable listHostTags for a custom domain-admin role via CloudMonkey
cloudmonkey update role id=<domain-admin-role-id> \
  name="DomainAdmin-Restricted"
cloudmonkey create rolepermission roleid=<domain-admin-role-id> \
  rule=listHostTags permission=deny