CVE-2026-50112: Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates
SSRF via Metalink Mirror URL Resolution:
An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.
RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:
An authenticated CloudStack tenant holding the default User role can execute arbitrary shell commands as root on the KVM hypervisor host that runs other tenants' VMs. This is cross-tenant root on the underlying compute, reachable via the public CloudStack API.
When a User registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and dispatches download to the KVM agent. Inner URLs inside the metalink XML are never re-validated against the scheme allowlist.
These issues affect Apache CloudStack: from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.20.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.22.1.1
Event History
Frequently Asked Questions
Who can exploit the KVM host command-execution issue?
An authenticated CloudStack tenant with the default User role can exploit it through the public CloudStack API. No elevated CloudStack administrative role is stated as necessary.
Which environments are exposed to cross-tenant host compromise?
CloudStack deployments using KVM are exposed because the issue permits commands to run as root on the KVM hypervisor hosting other tenants' VMs. The affected release ranges are 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0.
What attacker-controlled input triggers the issue?
The attacker registers a VM template with directDownload=true and a URL to an attacker-controlled .metalink file. The metalink's inner URLs are not revalidated against the scheme allowlist before the download is dispatched to the KVM agent.
What should operators do to remediate the issue?
Upgrade to Apache CloudStack 4.20.3.1 or 4.22.1.1, or a later version. These versions fix the reported issues.