CVE-2026-50222: Apache CloudStack: Improper access control in Userdata reference APIs
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.
Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.
This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CloudStackto a version that resolves this vulnerability.Fixed in 4.20.3.1 - Upgrade
Upgrade
Apache CloudStackto a version that resolves this vulnerability.Fixed in 4.22.1.1
Event History
Frequently Asked Questions
Which CloudStack deployments are affected?
Apache CloudStack versions 4.18.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected. The deleteCniConfiguration API is affected only in the 4.21.x and later affected branch because it was introduced in 4.21.0.0.
What access could an attacker gain?
The insufficient authorization checks may allow cross-tenant or cross-account access to userdata resources belonging to other tenants. The affected operations include deleting userdata, linking it to templates, resetting VM userdata, and using userdata-related VM deployment or update operations.
What should administrators do?
Upgrade to Apache CloudStack 4.20.3.1 or 4.22.1.1, or a later version. These releases fix the access-control issue.