CVE-2026-50112: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Apache Software Foundation Apache CloudStack

This vulnerability (CVE-2026-50112) in Apache CloudStack involves improper neutralization of special elements used in OS commands (CWE-78) and server-side request forgery (SSRF) via metalink mirror URL resolution. An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM retrieves and persists this data, which can be downloaded through normal APIs. When a user registers a VM template with directDownload=true and a URL to a .metalink file, the management server fetches the metalink XML and dispatches downloads to the KVM agent without re-validating inner URLs against the scheme allowlist. This allows an authenticated tenant with default User role to execute arbitrary shell commands as root on the KVM hypervisor host, enabling cross-tenant root access via the public CloudStack API. The affected versions are from 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The vendor recommends upgrading to 4.20.3.1 or 4.22.1.1 or later to remediate the issue.

Successful exploitation allows an authenticated tenant to achieve remote code execution as root on the KVM hypervisor host, resulting in cross-tenant compromise of the underlying compute infrastructure. This can lead to full system compromise, data breach, and disruption of services hosted on the affected hypervisor.

A fix is available. Users should upgrade Apache CloudStack to version 4.20.3.1 or 4.22.1.1 or later, which address this vulnerability by properly validating metalink URLs and preventing OS command injection. Until upgraded, restrict template registration privileges to trusted users only.