CVE-2026-66797 Overview
CVE-2026-66797 is an improper access control vulnerability [CWE-284] in Apache CloudStack's annotation functionality. The addAnnotation and listAnnotation APIs perform ownership checks when an entity's Universally Unique Identifier (UUID) is provided, but fail to enforce the check result. Any authenticated user can write annotations to, and read existing annotations or comments on, entities they do not own by supplying the target UUID. The flaw affects Apache CloudStack releases from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Apache has released fixed versions 4.20.3.1 and 4.22.1.1.
Critical Impact
Authenticated CloudStack users can create and disclose annotations on entities across tenancy boundaries, leaking operational metadata and enabling unauthorized comment injection.
Affected Products
- Apache CloudStack 4.15.0.0 through 4.20.3.0
- Apache CloudStack 4.21.0.0 through 4.22.1.0
- Fixed in Apache CloudStack 4.20.3.1 and 4.22.1.1
Discovery Timeline
- 2026-08-21 - CVE-2026-66797 published to the National Vulnerability Database
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-66797
Vulnerability Analysis
Apache CloudStack exposes an annotation subsystem that lets administrators and users attach comments to managed entities such as virtual machines, volumes, networks, and templates. Access to annotations is meant to follow the ownership and role model that governs the parent entity. The addAnnotation and listAnnotation API endpoints call an ownership check when a caller supplies an entity UUID, but the returned decision is not enforced by the calling code path. As a result, the request proceeds regardless of whether the caller has legitimate access to the referenced entity.
An authenticated user with any valid CloudStack API key can invoke these endpoints against arbitrary UUIDs. Reading annotations discloses operational notes, change history, or credentials operators may have inadvertently stored in comments. Writing annotations enables comment injection into other tenants' resources, which can mislead administrators, seed social-engineering content, or pollute audit trails.
Root Cause
The root cause is a broken access control pattern where the authorization function is invoked but its boolean or exception result is discarded before the sensitive operation executes. This is a classic [CWE-284] Improper Access Control defect. The check exists in code but does not gate the action, so the API layer treats every authenticated caller as authorized once entity resolution succeeds.
Attack Vector
Exploitation requires only network access to the CloudStack management API and valid low-privilege credentials. An attacker enumerates or guesses entity UUIDs, then issues addAnnotation or listAnnotation API calls referencing those UUIDs. No user interaction is required, and the attacker does not need to belong to the target account or domain. See the Apache Mailing List Discussion for the vendor advisory and disclosure thread.
Detection Methods for CVE-2026-66797
Indicators of Compromise
- API access logs showing addAnnotation or listAnnotation calls issued by user accounts that do not own the referenced entity UUID.
- Annotations appearing on entities without a corresponding legitimate administrative action in change-management records.
- Cross-account or cross-domain UUID references originating from a single API key within a short time window.
Detection Strategies
- Correlate CloudStack management-server logs against the account and domain of the entity UUID in each annotation request, and alert on mismatches.
- Baseline normal annotation volume per user and flag statistical anomalies, especially bursts of listAnnotation calls enumerating many UUIDs.
- Ingest CloudStack API audit logs into a centralized analytics platform and hunt for the vulnerable API names issued by non-administrative roles.
Monitoring Recommendations
- Enable verbose API request logging on the CloudStack management server and forward logs to a Security Information and Event Management (SIEM) platform.
- Monitor for UUID enumeration patterns such as sequential or scripted requests from a single source IP or API key.
- Review annotation contents periodically for unexpected authors, especially on production workloads and templates.
How to Mitigate CVE-2026-66797
Immediate Actions Required
- Upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1, or later on all management servers.
- Audit existing annotations for unauthorized entries created before the patch was applied and remove any that are illegitimate.
- Rotate CloudStack API keys for accounts that show anomalous addAnnotation or listAnnotation activity in historical logs.
Patch Information
Apache has fixed the flaw in Apache CloudStack 4.20.3.1 and 4.22.1.1. Operators running any release in the 4.15.0.0–4.20.3.0 or 4.21.0.0–4.22.1.0 ranges must upgrade. Consult the Apache Mailing List Discussion for the official advisory and release notes.
Workarounds
- Restrict management API access to trusted networks and administrative jump hosts using network-layer controls until patching is complete.
- Limit the issuance of API keys to roles that require them, and disable keys for accounts that do not need programmatic access.
- Increase audit-log retention and review cadence for annotation-related API calls during the exposure window.
# Verify installed CloudStack version and upgrade path
cloudstack-management --version
# Expected fixed versions: 4.20.3.1 or 4.22.1.1 (or later)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
