CVE-2025-66467: Apache CloudStack: MinIO policy remains intact on bucket deletion
Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners can gain unauthorized read and write access to it by using the previously generated access and secret keys.
Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66467?
CVE-2025-66467 is classified as a medium severity vulnerability due to the potential for unauthorized access to previously owned buckets.
How do I fix CVE-2025-66467?
To fix CVE-2025-66467, ensure that the MinIO policy cleanup process is implemented correctly on bucket deletion in Apache CloudStack.
Which versions of Apache CloudStack are affected by CVE-2025-66467?
CVE-2025-66467 affects Apache CloudStack versions up to 4.20.3.0 and 4.22.0.1.
What impact does CVE-2025-66467 have on user security?
The impact of CVE-2025-66467 can lead to unauthorized users potentially regaining access to sensitive data in buckets they previously owned.
What should I do if I have deployed an affected version of Apache CloudStack for CVE-2025-66467?
If you have deployed an affected version of Apache CloudStack, it's important to apply the recommended patches and updates to mitigate the vulnerability.