CVE-2026-66721: CWE-862 Missing Authorization in Apache Software Foundation Apache CloudStack
Description
CVE-2026-66721 is a missing authorization vulnerability in Apache CloudStack affecting the listHostTags API. Domain admins can call this API and receive host tags for all hosts in the environment, not just those scoped to their domain. This issue affects Apache CloudStack versions from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later resolves the issue.
CVSS v3.1
Score 2.7low
Affected software
Apache Software Foundation
Apache CloudStack
pkg:maven/org.apache.cloudstack/cloudstackRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability involves improper authorization checks in the listHostTags API of Apache CloudStack. Domain admins, who should only access host tags for hosts within their domain, can instead retrieve host tags for all hosts across the environment. This breaks domain scoping and could lead to unauthorized information disclosure. The flaw affects Apache CloudStack versions >=4.12.0.0 <=4.20.3.0 and >=4.21.0.0 <=4.22.1.0. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.
Potential Impact
The impact is limited to unauthorized information disclosure of host tags beyond the domain admin's scope. The CVSS score is 2.7 (low), indicating low severity with no impact on integrity or availability. There are no known exploits in the wild.
Mitigation Recommendations
Users should upgrade Apache CloudStack to version 4.20.3.1 or 4.22.1.1 or later to remediate this vulnerability. This is the official fix provided by the vendor.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-07-27T15:02:58.111Z
- State
- PUBLISHED
Threat ID: 6a88309facd9273b4907b8ab
Added to database: 08/21/2026, 11:03:59 UTC
Last enriched: 09/11/2026, 03:03:43 UTC
Last updated: 10/06/2026, 18:48:24 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.