CVE-2026-66722: Apache CloudStack Auth Bypass Vulnerability

CVE-2026-66722 Overview

CVE-2026-66722 is an authorization flaw in Apache CloudStack that allows a Domain Admin to perform create, read, update, and delete operations on project roles and project role permissions across any domain. The authorization check confirms the caller holds the Domain Admin role but fails to validate whether the target project belongs to the caller's domain or subdomain. A malicious Domain Admin can tamper with project roles and permissions in unrelated domains, undermining tenant isolation in multi-tenant CloudStack deployments. The vulnerability is tracked under CWE-285: Improper Authorization.

Critical Impact
A Domain Admin in one tenant can modify project roles and permissions in unrelated domains, breaking multi-tenant isolation and enabling privilege manipulation across the entire CloudStack deployment.

Affected Products

Apache CloudStack 4.15.0.0 through 4.20.3.0
Apache CloudStack 4.21.0.0 through 4.22.1.0
Fixed in Apache CloudStack 4.20.3.1 and 4.22.1.1

Discovery Timeline

2026-08-21 - CVE-2026-66722 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-66722

Vulnerability Analysis

Apache CloudStack organizes tenants using a hierarchy of domains and subdomains. Domain Admins have delegated authority over the projects, users, and resources within their own domain tree. Project roles and project role permissions govern what actions members can perform inside a project.

The vulnerable code paths handling CRUD operations on project roles and their permissions enforce a coarse role check. They confirm the caller is a Domain Admin but omit the ownership check that would ensure the target project resides in the caller's domain or a subdomain. As a result, a Domain Admin from Domain A can list, create, update, or delete project roles that belong to projects in Domain B.

The consequence is a broken tenant boundary. An attacker with legitimate Domain Admin credentials in one tenant can escalate influence into unrelated tenants by altering role permissions, granting excess privileges to project members, or removing permissions to disrupt operations.

Root Cause

The root cause is missing contextual authorization ([CWE-285]). The API handlers rely on role-based checks alone and do not perform a resource-ownership check to verify that the projectId (and its parent domain) is within the caller's domain scope. Authorization decisions require both the caller's role and the resource's location in the domain tree.

Attack Vector

Exploitation requires network access to the CloudStack management API and valid Domain Admin credentials. The attacker authenticates against the CloudStack API and issues project role management calls (such as those for creating, updating, listing, or deleting project roles and project role permissions) while specifying a projectId that belongs to a project outside their domain. The server accepts the request and applies the change.

No user interaction is required, complexity is low, and impact spans confidentiality, integrity, and availability of project role data across tenants.

No verified public exploit code is available. Refer to the Apache Mailing List Discussion for advisory details.

Detection Methods for CVE-2026-66722

Indicators of Compromise

Project role or project role permission changes where the acting user's domain does not match the target project's domain in CloudStack audit logs.
API calls to project role management endpoints (for example, createProjectRole, updateProjectRole, deleteProjectRole, createProjectRolePermission) originating from Domain Admin accounts targeting projectId values outside their domain scope.
Unexpected new project roles or altered permissions reported by project owners.

Detection Strategies

Correlate CloudStack management server logs and the usage and event tables to identify project role CRUD operations, then compare the acting account's domain path against the target project's domain path.
Baseline normal Domain Admin activity per tenant and alert when project role operations cross domain boundaries.
Review authentication and API access logs for Domain Admin accounts that suddenly interact with resources outside their historical scope.

Monitoring Recommendations

Ingest CloudStack management server and API audit logs into a centralized log platform for cross-domain query capability.
Alert on any successful project role or project role permission mutation where caller.domainId is not an ancestor of the target project's domainId.
Track privileged API usage volume per Domain Admin and flag anomalies against a per-account baseline.

How to Mitigate CVE-2026-66722

Immediate Actions Required

Upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1, or later as directed by the Apache advisory.
Audit existing project roles and project role permissions across all domains to identify unauthorized changes made prior to patching.
Review Domain Admin account assignments and revoke credentials that are no longer required.

Patch Information

Apache CloudStack has released fixed versions 4.20.3.1 and 4.22.1.1. These releases add the missing domain scope check to project role and project role permission CRUD operations. Operators running any release from 4.15.0.0 through 4.20.3.0 or 4.21.0.0 through 4.22.1.0 must upgrade. Follow the standard CloudStack upgrade procedure for the management server and validate API behavior in a staging environment before production rollout.

Workarounds

Temporarily restrict the pool of Domain Admin accounts and require additional approval workflows for role changes until patched.
Restrict network access to the CloudStack management API so that only trusted operators and management tooling can reach project role endpoints.
Increase audit log retention and enable real-time alerting on project role CRUD events to detect abuse until the upgrade is completed.

bash

# Verify the running CloudStack management server version
cloudstack-sccs || cat /usr/share/cloudstack-management/VERSION

# On RHEL/Rocky based systems, upgrade the management server packages
sudo yum clean all
sudo yum update cloudstack-management cloudstack-common
sudo systemctl restart cloudstack-management

# Confirm the upgraded version is 4.20.3.1, 4.22.1.1, or later
rpm -q cloudstack-management